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Flushing out the money launderers 
with better customer risk-rating 
models 


Advanced risk-rating models dramatically improve detection by applying 
machine learning and statistical analysis to better-quality data and 
dynamic customer profiles. 


M oney laundering is a serious problem for the global economy, with the sums 

involved variously estimated at between 2 and 5 percent of global GDP. Financial 
institutions are required by regulators to help combat money laundering and have invested 
billions of dollars to comply. Nevertheless, the penalties these institutions incur for 
compliance failure continue to rise: in 2017, fines were widely reported as having totaled $321 
billion since 2008 and $42 billion in 2016 alone. This suggests that regulators are 
determined to crack down but also that criminals are becoming increasingly sophisticated. 

Customer risk-rating models are one of three primary tools used by financial institutions to 
detect money laundering. The models deployed by most institutions today are based on an 
assessment of risk factors such as the customer’s occupation, salary, and the banking 
products used. The information is collected when an account is opened, but it is infrequently 
updated. These inputs, along with the weighting each is given, are used to calculate a risk¬ 
rating score. But the scores are notoriously inaccurate, not only failing to detect some high- 
risk customers, but often misclassifying thousands of low-risk customers as high risk. This 
forces institutions to review vast numbers of cases unnecessarily, which in turn drives up their 



costs, annoys many low-risk customers because of the extra scrutiny, and dilutes the 
effectiveness of anti-money laundering (AML) efforts as resources are concentrated in the 
wrong place. 

In the past, financial institutions have hesitated to do things differently, uncertain how 
regulators might respond. Yet regulators around the world are now encouraging innovative 
approaches to combat money laundering and leading banks are responding by testing 
prototype versions of new processes and practices. Some of those leaders have adopted 
the approach to customer risk rating described in this article, which integrates aspects of two 
other important AML tools: transaction monitoring and customer screening. The approach 
identifies high-risk customers far more effectively than the method used by most financial 
institutions today, in some cases reducing the number of incorrectly labeled high-risk 
customers by between 25 and 50 percent. It also uses AML resources far more efficiently. 

Best practice in customer risk rating 

To adopt the new generation of customer risk-rating models, financial institutions are 
applying five best practices: they simplify the architecture of their models, improve the quality 
of their data, introduce statistical analysis to complement expert judgment, continuously 
update customer profiles while also considering customer behavior, and deploy machine 
learning and network science tools. 

1. Simplify the model architecture 

Most AML models are overly complex. The factors used to measure customer risk have 
evolved and multiplied in response to regulatory requirements and perceptions of customer 
risk but still are not comprehensive. Models often contain risk factors that fail to distinguish 
between high- and low-risk countries, for example. In addition, methodologies for assessing 
risk vary by line of business and model. Different risk factors might be used for different 
customer segments, and even when the same factor is used it is often in name only. Different 
lines of business might use different occupational risk-rating scales, for instance. All this 
impairs the accuracy of risk scores and raises the cost of maintaining the models. 




Furthermore, a web of legacy and overlapping factors can make it difficult to ensure that 
important rules are effectively implemented. A person exposed to political risk might slip 
through screening processes if different business units use different checklists, for example. 

Under the new approach, leading institutions examine their AML programs holistically, first 
aligning all models to a consistent set of risk factors, then determining the specific inputs that 
are relevant for each line of business (Exhibit 1). The approach not only identifies risk more 
effectively but does so more efficiently, as different businesses can share the investments 
needed to develop tools, approaches, standards, and data pipelines. 

Exhibit 1 


Effective, efficient risk-rating models use a consistent set of risk factors, 
though inputs will vary by business line. 
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2. Improve data quality 



















Poor data quality is the single biggest contributor to the poor performance of customer risk¬ 
rating models. Incorrect know-your-customer (KYC) information, missing information on 
company suppliers, and erroneous business descriptions impair the effectiveness of 
screening tools and needlessly raise the workload of investigation teams. In many institutions, 
over half the cases reviewed have been labeled high risk simply due to poor data quality. 

The problem can be a hard one to solve as the source of poor data is often unclear. Any one of 
the systems that data passes through, including the process for collecting data, could 
account for identifying occupations incorrectly, for example. However, machine-learning 
algorithms can search exhaustively through subsegments of the data to identify where quality 
issues are concentrated, helping investigators identify and resolve them. Sometimes, natural- 
language processing (NLP) can help. One bank discovered that a great many cases were 
flagged as high risk and had to be reviewed because customers described themselves as a 
doctor or MD, when the system only recognized “physician” as an occupation. NLP algorithms 
were used to conduct semantic analysis and quickly fix the problem, helping to reduce the 
enhanced due-diligence backlog by more than 10 percent. In the longer term, however, 
better-quality data is the solution. 

3. Complement expert judgment with 
statistical analysis 

Financial institutions have traditionally relied on experts, as well as regulatory guidance, to 
identify the inputs used in risk-rating-score models and decide how to weight them. But 
different inputs from different experts contribute to unnecessary complexity and many 
bespoke rules. Moreover, because risk scores depend in large measure on the experts’ 
professional experience, checking their relevance or accuracy can be difficult. Statistically 
calibrated models tend to be simpler. And, importantly, they are more accurate, generating 
significantly fewer false-positive high-risk cases. 

Building a statistically calibrated model might seem a difficult task given the limited amount of 
data available concerning actual money-laundering cases. In the United States, suspicious 
cases are passed to government authorities that will not confirm whether the customer has 
laundered money. But high-risk cases can be used to train a model instead. A file review by 
investigators can help label an appropriate number of cases—perhaps 1,000—as high or low 




risk based on their own risk assessment. This data set can then be used to calibrate the 
parameters in a model by using statistical techniques such as regression. It is critical that the 
sample reviewed by investigators contains enough high-risk cases and that the rating is peer- 
reviewed to mitigate any bias. 

Experts still play an important role in model development, therefore. They are best qualified to 
identify the risk factors that a model requires as a starting point. And they can spot spurious 
inputs that might result from statistical analysis alone. However, statistical algorithms specify 
optimal weightings for each risk factor, provide a fact base for removing inputs that are not 
informative, and simplify the model by, for example, removing correlated model inputs. 


4. Continuously update customer profiles 
while also considering behavior 

Most customer risk-rating models today take a static view of a customer’s prof ile—his or her 
current residence or occupation, for example. However, the information in a profile can 
become quickly outdated: most banks rely on customers to update their own information, 
which they do infrequently at best. A more effective risk-rating model updates customer 
information continuously, flagging a change of address to a high-risk country, for example. A 
further issue with profiles in general is that they are of limited value unless institutions are 
considering a person’s behavior as well. We have found that simply knowing a customer’s 
occupation or the banking products they use, for example, does not necessarily add 
predictive value to a model. More telling is whether the customer’s transaction behavior is in 
line with what would be expected given a stated occupation, or how the customer uses a 
product. 

Take checking accounts. These are regarded as a risk factor, as they are used for cash 
deposits. But most banking customers have a checking account. So, while product risk is an 
important factor to consider, so too are behavioral variables. Evidence shows that customers 
with deeper banking relationships tend to be lower risk, which means customers with a 
checking account as well as other products are less likely to be high risk. The number of in- 
person visits to a bank might also help determine more accurately whether a customer with a 
checking account posed a high risk, as would his or her transaction behavior—the number 



and value of cash transactions and any cross-border activity. Connecting the insights from 
transaction-monitoring models with customer risk-rating models can significantly improve the 
effectiveness of the latter. 


While statistically calibrated risk-rating models perform better than manually calibrated ones, 
machine learning and network science can further improve performance. 


5. Deploy machine learning and network 
science tools 


While statistically calibrated risk-rating models perform better than manually calibrated ones, 
machine learning and network science can further improve performance. 

The list of possible model inputs is long, and many on the list are highly correlated and 
correspond to risk in varying degrees. Machine-learning tools can analyze all this. Feature- 
selection algorithms that are assumption-free can review thousands of potential model inputs 
to help identify the most relevant features, while variable clustering can remove redundant 
model inputs. Predictive algorithms (decision trees and adaptive boosting, for example) can 
help reveal the most predictive risk factors and combined indicators of high-risk customers— 
perhaps those with just one product, who do not pay bills but who transfer round-figure dollar 
sums internationally. In addition, machine-learning approaches can build competitive 
benchmark models to test model accuracy, and, as mentioned above, they can help fix data- 
quality issues. 

Network science is also emerging as a powerful tool. Here, internal and external data are 
combined to reveal networks that, when aligned to known high-risk typologies, can be used 
as model inputs. For example, a bank’s usual AML-monitoring process would not pick up 
connections between four or five accounts steadily accruing small, irregular deposits that are 
then wired to a merchant account for the purchase of an asset—a boat perhaps. The 
individual activity does not raise alarm bells. Different customers could simply be purchasing 
boats from the same merchant. Add in more data however—GPS coordinates of commonly 
used ATMs for instance—and the transactions start to look suspicious because of the 
connections between the accounts (Exhibit 2). This type of analysis could discover new, 



important inputs for risk-rating models. In this instance, it might be a network risk score that 
measures the risk of transaction structuring—that is, the regular transfer of small amounts 
intended to avoid transaction-monitoring thresholds. 


Exhibit 2 


Network science can reveal suspicious connections between apparently 
discrete accounts. 
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Network analytics can detect an inferred relationship 
based on historical patterns of co-location 


Although such approaches can be powerful, it is important that models remain transparent. 
Investigators need to understand the reasoning behind a model’s decisions and ensure it is 
not biased against certain groups of customers. Many institutions are experimenting with 
machine-based approaches combined with transparency techniques such as LIME or 
Shapley values that explain why the model classifies customers as high risk. 


Moving ahead 


Some banks have already introduced many of the five best practices. Others have further to 
go. We see three horizons in the maturity of customer risk-rating models and, hence, their 
effectiveness and efficiency (Exhibit 3). 




















Exhibit 3 


Moving along three horizons, the model becomes more sophisticated and thus 
greater in its effectiveness and efficiency. 
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Most banks are currently on horizon one, using models that are manually calibrated and give a 
periodic snapshot of the customer’s profile. On horizon two, statistical models use customer 
information that is regularly updated to rate customer risk more accurately. Horizon three is 
more sophisticated still. To complement information from customers’ profiles, institutions use 
network analytics to construct a behavioral view of how money moves around their 
customers’ accounts. Customer risk scores are computed via machine-learning approaches 
utilizing transparency techniques to explain the scores and accelerate investigations. And 
customer data are updated continuously while external data, such as property records, are 
used to flag potential data-quality issues and prioritize remediation. 

Financial institutions can take practical steps to start their journey toward horizon three, a 
process that may take anywhere from 12 to 36 months to complete (see sidebar, “The journey 
toward sophisticated risk-rating models”). 











As the modus operandi for money launderers becomes more sophisticated and their crimes 
more costly, financial institutions must fight back with innovative countermeasures. Among 
the most effective weapons available are advanced risk-rating models. These more 
accurately flag suspicious actors and activities, applying machine learning and statistical 
analysis to better-quality data and dynamic profiles of customers and their behavior. Such 
models can dramatically reduce false positives and enable the concentration of resources 
where they will have the greatest AML effect. Financial institutions undertaking to develop 
these models to maturity will need to devote the time and resources needed for an effort of 
one to three years, depending on each institution’s starting point. However, this is ajourney 
that most institutions and their employees will be keen to embark upon, given that it will make 
it harder for criminals to launder money. 



Derisking machine learning and 
artificial intelligence 


The added risk brought on by the complexity of machine-learning models 
can be mitigated by making well-targeted modifications to existing 
validation frameworks. 


Machine learning and artificial intelligence are set to transform the banking industry, using 
vast amounts of data to build models that improve decision making, tailor services, and 
improve risk management. According to the McKinsey Global Institute, this could generate 
value of more than $250 billion in the banking industry. 

But there is a downside, since machine-learning models amplify some elements of model risk. 
And although many banks, particularly those operating in jurisdictions with stringent 
regulatory requirements, have validation frameworks and practices in place to assess and 
mitigate the risks associated with traditional models, these are often insufficient to deal with 
the risks associated with machine-learning models. 

Conscious of the problem, many banks are proceeding cautiously, restricting the use of 
machine-learning models to low-risk applications, such as digital marketing. Their caution is 
understandable given the potential financial, reputational, and regulatory risks. Banks could, 
for example, find themselves in violation of antidiscrimination laws, and incur significant fines 
—a concern that pushed one bank to ban its HR department from using a machine-learning 




resume screener. A better approach, however, and ultimately the only sustainable one if 
banks are to reap the full benefits of machine-learning models, is to enhance model-risk 
management. 

Regulators have not issued specific instructions on how to do this. In the United States, they 
have stipulated that banks are responsible for ensuring that risks associated with machine¬ 
learning models are appropriately managed, while stating that existing regulatory guidelines, 
such as the Federal Reserve’s “Guidance on Model Risk Management” (SR11-7), are broad 
enough to serve as a guide. 

Enhancing model-risk management to address the risks of machine-learning models will 
require policy decisions on what to include in a model inventory, as well as determining risk 
appetite, risk tiering, roles and responsibilities, and model life-cycle controls, not to mention 
the associated model-validation practices. The good news is that many banks will not need 
entirely new model-validation frameworks. Existing ones can be fitted for purpose with some 
well-targeted enhancements. 

New risks, new policy choices, new 
practices 


There is no shortage of news headlines revealing the unintended consequences of new 
machine-learning models. Algorithms that created a negative feedback loop were blamed for 
the “flash crash” of the British pound by 6 percent in 2016, for example, and it was reported 
that a self-driving car tragically failed to properly identify a pedestrian walking her bicycle 
across the street. 

The cause of the risks that materialized in these machine-learning models is the same as the 
cause of the amplified risks that exist in all machine-learning models, whatever the industry 
and application: increased model complexity. Machine-learning models typically act on vastly 
larger data sets, including unstructured data such as natural language, images, and speech. 
The algorithms are typically far more complex than their statistical counterparts and often 
require design decisions to be made before the training process begins. And machine¬ 
learning models are built using new software packages and computing infrastructure that 
require more specialized skills. 



The response to such complexity does not have to be overly complex, however. If properly 
understood, the risks associated with machine-learning models can be managed within 
banks’ existing model-validation frameworks, as the exhibit below illustrates. 

Highlighted in the exhibit are the modifications made to the validation framework and 
practices employed by Risk Dynamics, McKinsey’s model-validation arm. This framework, 
which is fully consistent with SR11-7 regulations and has been used to validate thousands of 
traditional models in many different fields of banking, examines eight risk-management 
dimensions covering a total of 25 risk elements. By modifying 12 of the elements and adding 
only six new ones, institutions can ensure that the specific risks associated with machine 
learning are addressed. 

Exhibit 


Existing validation frameworks can address machine-learning-model risk with some 
well-targeted enhancements. 
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The six new elements 








The six new elements—interpretability, bias, feature engineering, hyperparameters, 
production readiness, and dynamic model calibration—represent the most substantive 
changes to the framework. 


Interpretability 

Machine-learning models have a reputation of being “black boxes.” Depending on the model’s 
architecture, the results it generates can be hard to understand or explain. One bank worked 
for months on a machine-learning product-recommendation engine designed to help 
relationship managers cross-sell. But because the managers could not explain the rationale 
behind the model’s recommendations, they disregarded them. They did not trust the model, 
which in this situation meant wasted effort and perhaps wasted opportunity. In other 
situations, acting upon (rather than ignoring) a model’s less-than-transparent 
recommendations could have serious adverse consequences. 

The degree of interpretability required is a policy decision for banks to make based on their 
risk appetite. They may choose to hold all machine-learning models to the same high 
standard of interpretability or to differentiate according to the model’s risk. In the United 
States, models that determine whether to grant credit to applicants are covered by fair¬ 
lending laws. The models therefore must be able to produce clear reason codes for a refusal. 
On the other hand, banks might well decide that a machine-learning model’s 
recommendations to place a product advertisement on the mobile app of a given customer 
poses so little risk to the bank that understanding the model’s reasons for doing so is not 
important. 

Validators need also to ensure that models comply with the chosen policy. Fortunately, 
despite the black-box reputation of machine-learning models, significant progress has been 
made in recent years to help ensure their results are interpretable. A range of approaches can 
be used, based on the model class: 

• Linear and monotonic models (for example, linear-regression models): linear 
coefficients help reveal the dependence of a result on the output. 



• Nonlinear and monotonic models, (for example, gradient-boosting models with 
monotonic constraint): restricting inputs so they have either a rising or falling 
relationship globally with the dependent variable simplifies the attribution of inputs to a 
prediction. 

• Nonlinear and nonmonotonic (for example, unconstrained deep-learning models): 
methodologies such as local interpretable model-agnostic explanations or Shapley 
values help ensure local interpretability. 

Bias 

A model can be influenced by four main types of bias: sample, measurement, and algorithm 
bias, and bias against groups or classes of people. The latter two types, algorithmic bias and 
bias against people, can be amplified in machine-learning models. 

For example, the random-forest algorithm tends to favor inputs with more distinct values, a 
bias that elevates the risk of poor decisions. One bank developed a random-forest model to 
assess potential money-laundering activity and found that the model favored fields with a 
large number of categorical values, such as occupation, when fields with fewer categories, 
such as country, were better able to predict the risk of money laundering. 

To address algorithmic bias, model-validation processes should be updated to ensure 
appropriate algorithms are selected in any given context. In some cases, such as random- 
forest feature selection, there are technical solutions. Another approach is to develop 
“challenger” models, using alternative algorithms to benchmark performance. 

To address bias against groups or classes of people, banks must first decide what constitutes 
fairness. Four definitions are commonly used, though which to choose may depend on the 
model’s use: 

• Demographic blindness: decisions are made using a limited set of features that are 
highly uncorrelated with protected classes, that is, groups of people protected by laws 
or policies. 

• Demographic parity: outcomes are proportionally equal for all protected classes. 

• Equal opportunity: true-positive rates are equal for each protected class. 



Equal odds: true-positive and false-positive rates are equal for each protected class. 




Validators then need to ascertain whether developers have taken the necessary steps to 
ensure fairness. Models can be tested for fairness and, if necessary, corrected at each stage 
of the model-development process, from the design phase through to performance 
monitoring. 

Feature engineering 

Feature engineering is often much more complex in the development of machine-learning 
models than in traditional models. There are three reasons why. First, machine-learning 
models can incorporate a significantly larger number of inputs. Second, unstructured data 
sources such as natural language require feature engineering as a preprocessing step before 
the training process can begin. Third, increasing numbers of commercial machine-learning 
packages now offer so-called AutoML, which generates large numbers of complex features 
to test many transformations of the data. Models produced using these features run the risk 
of being unnecessarily complex, contributing to overfitting. For example, one institution built a 
model using an AutoML platform and found that specific sequences of letters in a product 
application were predictive of fraud. This was a completely spurious result caused by the 
algorithm’s maximizing the model’s out-of-sample performance. 

In feature engineering, banks have to make a policy decision to mitigate risk. They have to 
determine the level of support required to establish the conceptual soundness of each 
feature. The policy may vary according to the model’s application. For example, a highly 
regulated credit-decision model might require that every individual feature in the model be 
assessed. For lower-risk models, banks might choose to review the feature-engineering 
process only: for example, the processes for data transformation and feature exclusion. 

Validators should then ensure that features and/or the feature-engineering process are 
consistent with the chosen policy. If each feature is to be tested, three considerations are 
generally needed: the mathematical transformation of model inputs, the decision criteria for 
feature selection, and the business rationale. For instance, a bank might decide that there is a 
good business case for using debt-to-income ratios as a feature in a credit model but not 
frequency of ATM usage, as this might penalize customers for using an advertised service. 



Hyperparameters 


Many of the parameters of machine-learning models, such as the depth of trees in a random- 
forest model or the number of layers in a deep neural network, must be defined before the 
training process can begin. In other words, their values are not derived from the available 
data. Rules of thumb, parameters used to solve other problems, or even trial and error are 
common substitutes. Decisions regarding these kinds of parameters, known as 
hyperparameters, are often more complex than analogous decisions in statistical modeling. 
Not surprisingly, a model’s performance and its stability can be sensitive to the 
hyperparameters selected. For example, banks are increasingly using binary classifiers such 
as support-vector machines in combination with natural-language processing to help identify 
potential conduct issues in complaints. The performance of these models and the ability to 
generalize can be very sensitive to the selected kernel function. 

Validators should ensure that hyperparameters are chosen as soundly as possible. For some 
quantitative inputs, as opposed to qualitative inputs, a search algorithm can be used to map 
the parameter space and identify optimal ranges. In other cases, the best approach to 
selecting hyperparameters is to combine expert judgment and, where possible, the latest 
industry practices. 

Production readiness 

Traditional models are often coded as rules in production systems. Machine-learning models, 
however, are algorithmic, and therefore require more computation. This requirement is 
commonly overlooked in the model-development process. Developers build complex 
predictive models only to discover that the bank’s production systems cannot support them. 
One US bank spent considerable resources building a deep learning-based model to predict 
transaction fraud, only to discover it did not meet required latency standards. 

Validators already assess a range of model risks associated with implementation. However, 
for machine learning, they will need to expand the scope of this assessment. They will need to 
estimate the volume of data that will flow through the model, assessing the production- 
system architecture (for example, graphics-processing units for deep learning), and the 
runtime required. 



Dynamic model calibration 


Some classes of machine-learning models modify their parameters dynamically to reflect 
emerging patterns in the data. This replaces the traditional approach of periodic manual 
review and model refresh. Examples include reinforcement-learning algorithms or Bayesian 
methods. The risk is that without sufficient controls, an overemphasis on short-term patterns 
in the data could harm the model’s performance over time. 

Banks therefore need to decide when to allow dynamic recalibration. They might conclude 
that with the right controls in place, it is suitable for some applications, such as algorithmic 
trading. For others, such as credit decisions, they might require clear proof that dynamic 
recalibration outperforms static models. 

With the policy set, validators can evaluate whether dynamic recalibration is appropriate given 
the intended use of the model, develop a monitoring plan, and ensure that appropriate 
controls are in place to identify and mitigate risks that might emerge. These might include 
thresholds that catch material shifts in a model’s health, such as out-of-sample performance 
measures, and guardrails such as exposure limits or other, predefined values that trigger a 
manual review. 


Banks will need to proceed gradually. The first step is to make sure model inventories include 
all machine learning-based models in use. You may be surprised to learn how many there are. 
One bank’s model risk-management function was certain the organization was not yet using 
machine-learning models, until it discovered that its recently established innovation function 
had been busy developing machine-learning models for fraud and cybersecurity. 

From here, validation policies and practices can be modified to address machine-learning- 
model risks, though initially for a restricted number of model classes. This helps build 
experience while testing and refining the new policies and practices. Considerable time will 
be needed to monitor a model’s performance and finely tune the new practices. But over time 
banks will be able to apply them to the full range of approved machine-learning models, 
helping companies mitigate risk and gain the confidence to start harnessing the full power of 
machine learning. 





The new frontier in anti-money 
laundering 


New analytical tools and surgical automation can help banks take the fight 
to fraudsters. 


I n recent years, three factors have heightened the risk banks face when combating 
financial crimes. First, the growth in volume of cross-border transactions and greater 
integration of the world’s economies have made banks inherently more vulnerable. Second, 
regulators are continually revising rules as their focus expands from organized crime to 
terrorism. Finally, governments have expanded their use of economic sanctions, targeting 
individual countries and even specific entities as part of their foreign policies. 

Banks have responded to these trends by investing heavily in people, manual controls 
(“checkers checking the checkers”), and systems addressing point-in-time needs. For 
example, in the United States, anti-money laundering (AML) compliance staff have increased 
up to tenfold at major banks over the past five years or so. Banks have typically used a 
piecemeal approach, adding staff to areas with the weakest controls. Often this has resulted 
in compliance programs built for individual countries, product lines, and customer segments— 
with all the duplication that suggests. Banks have also hired thousands of investigators to 
manually review high-risk transactions and accounts identified through inefficient, exception- 
based rules. For example, one big US bank expanded the ranks of its compliance team by 
one-third in recent years, including many people who work on “know your customer” (KYC) 
and AML compliance. Banks are also spending hundreds of millions of dollars to maintain the 
processes and systems they built in response to remediation needs. 



As a result, second-line AML compliance programs now look more like operational utilities or, 
as one executive put it, “factories,” and less like the independent oversight functions that 
banks first envisioned. These factories are expensive, yet might be acceptable if the huge 
teams and manual processes were working well. But many are not. Most financial institutions 
continue to face challenges that erode the effectiveness and efficiency of their AML 
programs, including the following: 

• Poor-quality data, nonstandard data structures, and fragmented sources make data 
aggregation by legal entities, subsidiaries, and vendors difficult. For example, many 
banks are still making tens of thousands of costly customer calls every month to refresh 
KYC documents, updating information that is incorrect or missing in their databases. 

• Analytical approaches for customer risk scoring and transaction monitoring suffer from 
high rates of false positives, resulting in significant resources focused on investigating 
low-risk accounts and transactions. Adding new calibration tools and thresholds often 
leads to another spike in the number of false alerts. 

• Inconsistent standards in processes such as customer identification, enhanced due 
diligence, and account monitoring and screening mean that businesses do not agree on 
what constitutes risk and violation of compliance requirements. 

• Similarly, inconsistency in the reporting of suspicious activities and currency 
transactions means banks sometimes produce too many reports, and sometimes too 
few, exposing them to the twin dangers of regulatory sanctions and excessive cost. 

• Fragmented systems and platforms limit the ability to automate transaction monitoring 
and due diligence. Instead, compliance teams spend the bulk of their time collecting 
data, and then on “stare and compare” sessions, instead of investigative work. 

• Reliable quantitative metrics to assess risk across products, geographies, and 
processes are often not available. 

• Ever-faster launches of new products and services, as well as instant fund transfers 
and mobile payments, add complexity to real-time detection and prevention. For 
example, “intelligent” ATMs allowing customers to anonymously deposit and transfer 
cash even when banks are closed certainly offer convenience but lack adequate KYC 
and AML safeguards. 



Leading banks are trying to crack these problems by turning to new technologies. Machine 
learning, real-time data-aggregation platforms using fuzzy logic, rapid automation, and text 
and voice analytics offer a fundamentally new approach to managing compliance. Even 
better, they also offer an opportunity to simultaneously cut structural costs and improve the 
customer experience. As they take up these new tools, banks are shifting financial-crime 
compliance toward a more forward-looking and sustainable approach. 

Traditional improvements in operations, governance, and management information systems 
will continue to be important elements in financial-crime prevention programs. But 
technology and advanced analytics can raise these programs to much higher levels of 
effectiveness and efficiency. While there are many opportunities, our experience shows that 
banks should invest in three areas: efficient data-aggregation platforms, advanced statistical 
modeling (such as machine learning-based risk scoring and alert-generation engines), and 
automation of processes (such as investigator visualization tools). 

Banks that invest strategically in these three areas, rather than tactically reacting to market 
and regulatory changes, can over time substantially reduce their risk exposure and capture 
other substantial benefits. For example, compliance-error rates measured through sample- 
based testing can be reduced from more than 30 percent to less than 5 percent. At the same 
time, false-positive alerts can be brought down from over 90 percent to below 50 percent. 
These steps reduce the risk of regulatory fines and other penalties related to noncompliance, 
as well as help banks avoid potential reputational issues. The following discussions review 
ideas and techniques in the three areas and suggest ways banks can apply them. 


Data aggregation 


Banks in all markets struggle with the quality of data they keep on their customers, creating a 
significant obstacle to data aggregation. Longtime clients may have signed up when 
information standards weren’t as rigorous and manual forms were prone to error. Most banks 
have established modern data-entry processes for new customers—yet these might be 
followed inconsistently across countries or even branches. The challenge can be especially 
daunting in some countries like the United States or the United Kingdom that have only partial 
nationwide identification systems. 





Banks are turning to new tools to aggregate poor-quality data that can help them avoid 
hundreds of thousands of dollars in cost for manual data structuring and cleansing as well as 
hundreds of millions of dollars in investments required to build central “data lakes.” For 
example, intelligent data platforms use machine learning or “fuzzy logic” (an approach to 
computing based on degrees of truth, rather than the more conventional binary true/false 
logic) on unstructured account and transaction data, to create a 360-degree view of 
suspected cases of money laundering. In practice, these new tools allow banks to 
automatically validate more customer identities, identify beneficial owners faster, and map 
how specific customers are connected to other individuals and legal entities, especially those 
earmarked as higher risks. 

This can have significant implications on the volume of accounts and transactions that get 
escalated for manual reviews. For example, our analysis at one global institution showed that 
about half of the transactions flagged as “suspicious” would not have needed investigation if 
the bank had been able to connect the data held by its various divisions, some of which had 
identified and previously cleared the parties involved. 

As another example, in a typical bank, data infrastructure and systems are not well positioned 
to quickly spot the connections among small cash deposits made by many different 
customers and wire transfers sent by those customers to the same recipient. The exhibit 
illustrates how a typical “smurfing” scheme works, in which cash deposits are broken down 
into amounts below the reporting threshold of $10,000. Analytics-driven data aggregation 
can help overcome these challenges by instantly connecting these individuals to the same 
geographic location, same behavioral pattern (for example, transaction types, frequency, and 
sequence), same destination account, and even block the wires from leaving the bank early in 
the process, before the laundered amount gets big. 



Exhibit 


How ‘smurfs’ tie together small deposits and wires, evading 
anti-money laundering detection. 


Money laundering 

3. Each member deposits 
$1,000 into his or her own 
account at the beginning 
of each week 
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The typical anti-money laundering monitoring process will not detect small regular deposits 


1. A criminal group of 2. Each member has an 

30 members operates in account with the bank 

Los Angeles 


4. At the end of the week, each member wires $1,000 to the same account in Hong Kong 
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The typical anti-money laundering monitoring process will not detect the wiring of funds 
from multiple accounts to a common receiver overseas 


Advanced analytics 








Intelligent data aggregation is not the only opportunity to apply advanced analytics in the 
AML space. Consider customer risk scoring and the tools used to generate alerts on 
suspicious transactions. Current tools are often not statistical models at all, but rather a series 
of linear rules based on an institution’s experience, a typology of known money-laundering 
events, and explicit regulatory requirements (such as reporting any wire transfers of more 
than $10,000). Regrettably for banks, up to 90 percent of the alerts generated by these rules 
can be false positives, and should be quickly discarded by investigators (but often are not). 
Though rarer, false negatives (or criminal activity that goes unnoticed) also pose a significant 
risk to banks. It is relatively easy for criminals to understand the linear rules currently applied 
by many banks and then design approaches to circumvent them (like smurfing, including the 
use of dormant intermediary accounts before the funds converge into the target account). 

Statistical models based on machine learning and other forms of artificial intelligence can 
help banks raise their game. Such models review verified events to identify the often obscure 
combinations of predictive variables most likely to help minimize losses. Learning algorithms 
take advantage of the large pools of data and heightened computing power now available to 
detect patterns that might go unnoticed by data scientists. Systems using artificial 
intelligence can discern, for example, whether a series of transactions represents possible 
money laundering or a more innocent activity, such as a sudden wave of overseas expenses. 

In our experience, machine-learning algorithms can help reduce the number of false reports 
by 20 to 30 percent. As a result, investigators can spend more time on high-risk cases, and 
the manual work required can be reduced by as much as 50 percent. 

The impact of advanced statistical modeling is further increased when it’s applied across a 
network of financial institutions. For example, one major European payments processor 
implemented machine-learning algorithms to follow the money across many banks and 
various entities, accounts, and locations. The approach allowed investigators to identify the 
paths used by “mule” accounts that are notoriously difficult to detect. Such accounts, spread 
across several financial institutions, bounce and “clean” the funds as they move from an illegal 
source into the formal financial system. Besides identifying the at-risk accounts in their 
network, investigators were able to develop powerful predictive variables to flag suspicious 
transactions and accounts newly entering the legal payments system. Forewarned is 
forearmed: banks that are on the alert for markers of increased money-laundering risk—such 
as use of bitcoin services, prepaid cards, accounts opened by foreign students overseas—are 
able to stop transfers in real time. 



The financial industry has been slow to adopt advanced tools such as machine learning, partly 
because the models are difficult to explain and validate to satisfy regulatory requirements. 
However, the techniques are becoming commonplace in other parts of the bank. Machine¬ 
learning algorithms are being used to offer better products and advice to customers, as well 
as to manage customer retention more effectively. Regulators are becoming more 
comfortable with validation approaches involving such algorithms as random forest, which 
produce models that are relatively easy to explain and test for stability. 

Banks can start with simple uses of analytics, like those involved in smart triage and 
microsegmentation of accounts and transactions to reduce false positives. For example, 
instead of making binary “file/do not file” decisions, some banks score each account and 
transaction that did not immediately require filing of suspicious activity reports (SARs). They 
“hibernate” them until the cumulative view of triggers over time surpasses a predetermined 
threshold. Some institutions achieved a threefold improvement in SAR conversion rates 
through tighter segmentation of accounts and transactions based on behavioral and 
demographic characteristics, allowing them to distinguish between suspicious and 
nonsuspicious transactions the same way experienced investigators do. 

Down the road, other tools might accelerate progress, given AML’s heavy reliance on human 
judgment and expertise. Deep learning is an advanced form of machine learning that is 
already being used in image analysis and human language processing. It attempts to mimic 
human thought processes like those used by financial-crimes investigators and requires large 
amounts of data and fine-tuned models. Deep learning will likely start being deployed at scale 
in the next three to five years for banks to combat money laundering, fraud, and other 
financial crimes. 


Automated processes 


Automation and standardization of critical portions of the due diligence and investigation 
processes can make expert staff more effective and significantly reduce their caseload. 
Robots can be used to automate certain activities, including the population of case files for 
investigators, the closing of level-one alerts, and the population of SAR forms. These 
measures can reduce the investigation time for alerts and allow for workforce optimization. 



For example, a leading North American wealth manager used many techniques to move from 
a largely manual process for customer identification and due diligence to a re-engineered and 
tech-enabled process. The solution included case-management workflow to guide due- 
diligence analysts faster and more effectively through the process; an integrated interface to 
bring all the data and third-party applications that analysts typically need into a single screen; 
rules-driven pipeline management to ensure priority-based resolution of cases; and so on. 
Under the new processes, staff were able to make decisions on low- to medium-risk 
customers almost instantly, and within 24 hours on most high-risk clients. The initiative also 
enhanced the customer experience by speeding up decisions and eliminating unnecessary 
follow-ups for missing information. All told, the firm was able to improve operational 
efficiencies in KYC by up to 50 percent. 

The integrated interface is particularly important for speeding up the alert-investigation 
process and can be quickly acquired and deployed from a number of third-party vendors. This 
type of tool automatically gathers information through online searches, internal data, and 
third-party databases, and highlights concerns such as relevant sanctions, negative media, 
and political exposure. This information is visualized into a clear, on-screen report that helps 
an investigator quickly assess the case and make a decision. 

Filing of SARs with regulators is another area that presents high potential for automation. 
Natural-language-processing (NLP) software converts data into text and can replace most of 
the work that investigators are traditionally putting into writing the reports that support their 
decisions on a case when it’s filed. Integrated with the case-management workflows, NPL 
applications can be really powerful tools that automatically generate the SARs as soon as the 
investigator pushes the “generate report” button—all it takes is a quick review and editing, 
followed by pushing of the “file report” button. 


How to get there 


Our experience suggests that analytics and technology are important, but they alone will not 
provide a silver-bullet solution to all AML challenges. The key to impact is being able to deploy 
analytics and technology in a business-specific way and to embed them organically into 
business processes, which in turn often have to be fundamentally reshaped to take 
advantage of new tools. 



With this context in mind, leading institutions are focusing on four key initiatives to both 
generate substantial value in the near-term and course correct their in-flight efforts to 
achieve a more sustainable target operating model: 


1. Develop a truly end-to-end view of an optimized, tech-enabled KYC and AML process, 
starting with new standards for customer-data intake to customer identification to risk- 
based due diligence to monitoring. The design of this “north star” process should cover 
complexity-based triage, rules-based routing of files to investigators, standards of 
work, quality tailgates, and so on. Currently no single third party supports the entire 
process; hence the bar is very high for upfront system-architecture design and 
integration of internal and third-party point-to-point solutions. 

2. Define a strategy for data quality and aggregation, including linking KYC and AML data 
closer together. Consider application of analytical tools such as fuzzy logic and machine 
learning to connect the dots in the known KYC/AML reference data—such as customer 
investments and associated entities and individuals—and sanctions data. This will 
address a significant share of customer due-diligence escalations. It will also end many 
of the sanctions and transaction-monitoring alerts that result from gaps and problems 
with matching reference data, including known intracompany and intercompany 
transfers and customer identification data from another business unit. 

3. Fold simple analytical approaches like microsegmentation into current systems and 
model validation processes. In this way added rules on top of existing rule engines for 
customer risk scoring and alert generation can be consolidated. In parallel, banks can 
invest in longer-term solutions such as training neural networks through supervised 
learning, which will further reduce false positives and false negatives. These tools can 
be brought up to high performance and be ready to go once regulatory approval is 
completed. 

4. Implement a set of metrics and practices to measure effectiveness of the KYC/AML 
processes and assess impact from operational and system improvements. Potential 
metrics could include the following: 

o Establish the expected volume and quantity of alerts. For example, set targets 
in 90-day intervals to reduce false alerts as new controls are launched. 



° Set rate of conversion of alerts to cases: for example, aim to reduce the SAR 
conversion rate by 1 or 2 percent every 90 days. 

° Reduce time per case: for example, set a target to reduce the investigation 
time by case type. 

° Set targets to reduce false positives and negatives, rather than focusing on 
the number of SARs filed or overall transaction volumes. 


The industry is at a turning point. Not only are many banks reconsidering their approach to 
KYC and AML, but many regulatory technology start-ups are launching products to support 
and sometimes supplant their efforts. Every new technology reaches a point when the 
hurdles fall away, and the benefits become too numerous to ignore any longer. As pioneering 
banks are finding out, automation and analytics for AML are at that point. 


Controlling machine-learning 
algorithms and their biases 


Myths aside, artificial intelligence is as prone to bias as the human kind. 
The good news is that the biases in algorithms can also be diagnosed and 
treated. 


C ompanies are moving quickly to apply machine learning to business decision 

making. New programs are constantly being launched, setting complex algorithms to 
work on large, frequently refreshed data sets. The speed at which this is taking place attests 
to the attractiveness of the technology, but the lack of experience creates real risks. 
Algorithmic bias is one of the biggest risks because it compromises the very purpose of 
machine learning. This often-overlooked defect can trigger costly errors and, left unchecked, 
can pull projects and organizations in entirely wrong directions. Effective efforts to confront 
this problem at the outset will repay handsomely, allowing the true potential of machine 
learning to be realized most efficiently. 


Machine learning has been in scientific use for more than half a century as a term describing 
programmable pattern recognition. The concept is even older, having been expressed by 
pioneering mathematicians in the early 19th century. It has come into its own in the past two 
decades, with the advent of powerful computers, the Internet, and mass-scale digitization of 
information. In the domain of artificial intelligence, machine learning increasingly refers to 




computer-aided decision making based on statistical algorithms generating data-driven 
insights (see sidebar, “Machine learning: The principal approach to realizing the promise of 
artificial intelligence”). 

Among its most visible uses is in predictive modeling. This has wide and familiar business 
applications, from automated customer recommendations to credit-approval processes. 
Machine learning magnifies the power of predictive models through great computational 
force. To create a functioning statistical algorithm by means of a logistic regression, for 
example, missing variables must be replaced by assumed numeric values (a process called 
imputation). Machine-learning algorithms are often constructed to interpret “missing” as a 
possible value and then proceed to develop the best prediction for cases where the value is 
missing. Machine learning is able to manage vast amounts of data and detect many more 
complex patterns within them, often attaining superior predictive power. 

In credit scoring, for example, customers with a long history of maintaining loans without 
delinquency are generally determined to be of low risk. But what if the mortgages these 
customers have been maintaining were for years supported by substantial tax benefits that 
are set to expire? A spike in defaults may be in the offing, unaccounted for in the statistical 
risk model of the lending institution. With access to the right data and guidance by subject- 
matter experts, predictive machine-learning models could find the hidden patterns in the data 
and correct for such spikes. 

The persistence of bias 

In automated business processes, machine-learning algorithms make decisions faster than 
human decision makers and at a fraction of the cost. Machine learning also promises to 
improve decision quality, due to the purported absence of human biases. Human decision 
makers might, for example, be prone to giving extra weight to their personal experiences. This 
is a form of bias known as anchoring, one of many that can affect business decisions. 
Availability bias is another. This is a mental shortcut (heuristic) by which people make familiar 
assumptions when faced with decisions. The assumptions will have served adequately in the 
past but could be unmerited in new situations. Confirmation bias is the tendency to select 
evidence that supports preconceived beliefs, while loss-aversion bias imposes undue 
conservatism on decision-making processes. 



Machine learning is being used in many decisions with business implications, such as loan 
approvals in banking, and with personal implications, such as diagnostic decisions in hospital 
emergency rooms. The benefits of removing harmful biases from such decisions are obvious 
and highly desirable, whether they come in financial, medical, or some other form. 

Some machine learning is designed to emulate the mechanics of the human brain, such as 
deep learning, with its artificial neural networks. If biases affect human intelligence, then what 
about artificial intelligence? Are the machines biased? The answer, of course, is yes, for some 
basic reasons. First, machine-learning algorithms are prone to incorporating the biases of 
their human creators. Algorithms can formalize biased parameters created by sales forces or 
loan officers, for example. Where machine learning predicts behavioral outcomes, the 
necessary reliance on historical criteria will reinforce past biases, including stability bias. This 
is the tendency to discount the possibility of significant change—for example, through 
substitution effects created by innovation. The severity of this bias can be magnified by 
machine-learning algorithms that must assume things will more or less continue as before in 
order to operate. Another basic bias-generating factor is incomplete data. Every machine¬ 
learning algorithm operates wholly within the world defined by the data that were used to 
calibrate it. Limitations in the data set will bias outcomes, sometimes severely. 

Predicting behavior: ‘Winner takes all’ 

Machine learning can perpetuate and even amplify behavioral biases. By design, a social- 
media site filtering news based on user preferences reinforces natural confirmation bias in 
readers. The site may even be systematically preventing perspectives from being challenged 
with contradictory evidence. The self-fulfilling prophecy is a related by-product of algorithms. 
Financially sound companies can run afoul of banks’ scoring algorithms and find themselves 
without access to working capital. If they are unable to sway credit officers with factual logic, 
a liquidity crunch could wipe out an entire class of businesses. These examples reveal a 
certain “winner takes all” outcome that affects those machine-learning algorithms designed 
to replicate human decision making. 


Data limitations 



Machine learning can reveal valuable insights in complex data sets, but data anomalies and 
errors can lead algorithms astray. Just as a traumatic childhood accident can cause lasting 
behavioral distortion in adults, so can unrepresentative events cause machine-learning 
algorithms to go off course. Should a series of extraordinary weather events or fraudulent 
actions trigger spikes in default rates, for example, credit scorecards could brand a region as 
“high risk” despite the absence of a permanent structural cause. In such cases, inadequate 
algorithms will perpetuate bias unless corrective action is taken. 

Companies seeking to overcome biases with statistical decision-making processes may find 
that the data scientists supervising their machine-learning algorithms are subject to these 
same biases. Stability biases, for example, may cause data scientists to prefer the same data 
that human decision makers have been using to predict outcomes. Cost and time pressures, 
meanwhile, could deter them from collecting other types of data that harbor the true drivers 
of the outcomes to be predicted. 

The problem of stability bias 

Stability bias—the tendency toward inertia in an uncertain environment—is actually a 
significant problem for machine-learning algorithms. Predictive models operate on patterns 
detected in historical data. If the same patterns cease to exist, then the model would be akin 
to an old railroad timetable—valuable for historians but not useful for traveling in the here and 
now. It is frustratingly difficult to shape machine-learning algorithms to recognize a pattern 
that is not present in the data, even one that human analysts know is likely to manifest at 
some point. To bridge the gap between available evidence and self-evident reality, synthetic 
data points can be created. Since machine-learning algorithms try to capture patterns at a 
very detailed level, however, every attribute of each synthetic data point would have to be 
crafted with utmost care. 

In 2007, an economist with an inkling that credit-card defaults and home prices were linked 
would have been unable to build a predictive model showing this relationship, since it had not 
yet appeared in the data. The relationship was revealed, precipitously, only when the financial 
crisis hit and housing prices began to fall. If certain data limitations are permitted to govern 
modeling choices, seriously flawed algorithms can result. Models will be unable to recognize 
obviously real but unexpected changes. Some US mortgage models designed before the 



financial crisis could not mathematically accept negative changes in home prices. Until 
negative interest rates appeared in the real world, they were statistically unrecognized and no 
machine-learning algorithm in the world could have predicted their appearance. 

Addressing bias in machine-learning 
algorithms 

As described in a previous article in McKinseyon Risk, companies can take measures to 
eliminate bias or protect against its damaging effects in human decision making. Similar 
countermeasures can protect against algorithmic bias. Three filters are of prime importance. 

First, users of machine-learning algorithms need to understand an algorithm’s shortcomings 
and refrain from asking questions whose answers will be invalidated by algorithmic bias. 

Using a machine-learning model is more like driving a car than riding an elevator. To get from 
point A to point B, users cannot simply push a button; they must first learn operating 
procedures, rules of the road, and safety practices. 

Second, data scientists developing the algorithms must shape data samples in such a way 
that biases are minimized. This step is a vital and complex part of the process and worthy of 
much deeper consideration than can be provided in this short article. For the moment, let us 
remark that available historical data are often inadequate for this purpose, and fresh, 
unbiased data must be generated through a controlled experiment. 

Finally, executives should know when to use and when not to use machine-learning 
algorithms. They must understand the true values involved in the trade-off: algorithms offer 
speed and convenience, while manually crafted models, such as decision trees or logistic 
regression—or for that matter even human decision making—are approaches that have more 
flexibility and transparency. 

What’s in your black box? 

From a user’s standpoint, machine-learning algorithms are black boxes. They offer quick and 
easy solutions to those who know little or nothing of their inner workings. They should be 
applied with discretion, but knowing enough to exercise discretion takes effort. Business 



users seeking to avoid harmful applications of algorithms are a little like consumers seeking 
to eat healthy food. Health-conscious consumers must study literature on nutrition and read 
labels in order to avoid excess calories, harmful additives, or dangerous allergens. Executives 
and practitioners will likewise have to study the algorithms at the core of their business and 
the problems they are designed to resolve. 

They will then be able to understand monitoring reports on the algorithms, ask the right 
questions, and challenge assumptions. 

In credit scoring, for example, built-in stability bias prevents machine-learning algorithms 
from accounting for certain rapid behavioral shifts in applicants. These can occur if applicants 
recognize the patterns that are being punished by models. Salespeople have been known to 
observe the decision patterns embedded in algorithms and then coach applicants by reverse¬ 
engineering the behaviors that will maximize the odds of approval. 

A subject that frequently arises as a predictor of risk in this context is loan tenor. Riskier 
customers generally prefer longer loan tenors, in recognition of potential difficulties in 
repayment. Many low-risk customers, by contrast, aim to minimize interest expense by 
choosing shorter tenors. A machine-learning algorithm would jump on such a pattern, 
penalizing applications for longer tenors with a higher risk estimate. Soon salespeople would 
nudge risky applicants into the approval range of the credit score by advising them to choose 
the shortest possible tenor. Burdened by an exceptionally high monthly installment (due to the 
short tenor), many of these applicants will ultimately default, causing a spike in credit losses. 

Astute observers can thus extract from the black box the variables with the greatest influence 
on an algorithm’s predictions. Business users should recognize that in this case loan tenor 
was an influential predictor. They can either remove the variable from the algorithm or put in 
place a safeguard to prevent a behavioral shift. Should business users fail to recognize these 
shifts, banks might be able to identify them indirectly, by monitoring the distribution of 
monthly applications by loan tenor. The challenge here is to establish whether a marked shift 
is due to a deliberate change in behavior by applicants or to other factors, such as changes in 
economic conditions or a bank’s promotional strategy. In one way or the other, sound 
business judgment therefore is indispensable. 



Squeezing bias out of the development 
sample 


Tests can ensure that unwanted biases of past human decision makers, such as gender 
biases, for example, have not been inadvertently baked into machine-learning algorithms. 
Here a challenge lies in adjusting the data such that the biases disappear. 

One of the most dangerous myths about machine learning is that it needs no ongoing human 
intervention. Business users would do better to view the application of machine-learning 
algorithms like the creation and tending of a garden. Much human oversight is needed. 

Experts with deep machine-learning knowledge and good business judgment are like 
experienced gardeners, carefully nurturing the plants to encourage their organic growth. The 
data scientist knows that in machine learning the answers can be useful only if we ask the 
right questions. 

In countering harmful biases, data scientists seek to strengthen machine-learning algorithms 
where it most matters. Training a machine-learning algorithm is a bit like building muscle 
mass. Fitness trainers take great pains in teaching their clients the proper form of each 
exercise so that only targeted muscles are worked. If the hips are engaged in a motion 
designed to build up biceps, for example, the effectiveness of the exercise will be much 
reduced. By using stratified sampling and optimized observation weights, data scientists 
ensure that the algorithm is most powerful for those decisions in which the business impact of 
a prediction error is the greatest. This cannot be done automatically, even by advanced 
machine-learning algorithms such as boosting (an algorithm designed to reduce algorithmic 
bias). Advanced algorithms can correct for a statistically defined concept of error, but they 
cannot distinguish errors with high business impact from those of negligible importance. 
Another example of the many statistical techniques data scientists can deploy to protect 
algorithms from biases is the careful analysis of missing values. By determining whether the 
values are missing systematically, data scientists are introducing “hindsight bias.” This use of 
bias to fight bias allows the algorithm to peek beyond its data-determined limitations to the 
correct answer. The data scientists can then decide whether and how to address the missing 
values or whether the sample structure needs to be adjusted. 



Deciding when to use machine-learning 
algorithms 

An organization considering using an algorithm on a business problem should be making an 
explicit choice based on the cost-benefit trade-off. A machine-learning algorithm will be fast 
and convenient, but more familiar, traditional decision-making processes will be easier to 
build for a particular purpose and will also be more transparent. Traditional approaches 
include human decision making or handcrafted models such as decision trees or logistic- 
regression models—the analytic workhorses used for decades in business and the public 
sector to assign probabilities to outcomes. The best data scientists can even use machine¬ 
learning algorithms to enhance the power of handcrafted models. They have been able to 
build advanced logistic-regression models with predictive power approaching that of a 
machine-learning algorithm. 

Three questions can be considered when deciding to use machine-learning algorithms: 

• How soon do we need the solution? The time factor is often of prime importance in 
solving business problems. The optimal statistical model may be obsolete by the time it 
is completed. When the business environment is changing fast, a machine-learning 
algorithm developed overnight could far outperform a superior traditional model that is 
months in the making. For this reason, machine-learning algorithms are preferred for 
combating fraud. Defrauders typically act quickly to circumvent the latest detection 
mechanisms they encounter. To defeat fraud, organizations need to deploy algorithms 
that adjust instantaneously, the moment the defrauders change their tactics. 

• What insights do we have? The superiority of the handcrafted model depends on the 
business insights embedded in it by the data scientist. If an organization possesses no 
insights, then the problem solving will have to be guided by the data. At this point, a 
machine-learning algorithm might be preferred for its speed and convenience. 

However, rather than blindly trusting an algorithm, an organization in this situation could 
decide that it is better to bring in a consultant to help develop value-adding business 
insights. 

• Which problems are worth solving? One of the promises of machine learning is that it 
can address problems that were once unrecognized or thought to be too costly to solve 
with a handcrafted model. Decision making on these problems has been heretofore 



random or unconscious. When reconsidering such problems, organizations should 
identify those with significant bottom-line business impact and then assign their best 
data scientists to work on them. 

In addition to these considerations, companies implementing large-scale machine-learning 
programs should make appropriate organizational and cultural changes to support them. 
Everyone within the scope of the programs should understand and trust the machine¬ 
learning models—only then will maximum impact be achieved. 

Implementation: Standards, validation, 
knowledge 

How would a business go about implementing these recommendations? The practical 
application and debiasing of machine-learning algorithms should be governed by a conscious 
and eventually systematic process throughout the organization. While not as stringent and 
formal, the approach is related to mature model development and validation processes by 
which large institutions are gaining strategic control of model proliferation and risk. Three 
building blocks are critically important for implementation: 

• Business-based standards for machine-learning approvals. A template should be 
developed for model documentation, standardizing the process for the intake of 
modeling requests. It should include the business context and prompt requesters with 
specific questions on business impact, data, and cost-benefit trade-offs. The process 
should require active user participation in the drive to find the most suitable solution to 
the business problem (note that passive check-lists or guidelines, by comparison, tend 
to be ignored). The model’s key parameters should be defined, including a standard set 
of analyses to be run on the raw data inputs, the processed sample, and the modeling 
outputs. The model should be challenged in a discussion with business users. 

• Professional validation of machine-learning algorithms. An explicit process is needed 
for validating and approving machine-learning algorithms. Depending on the industry 
and business context—especially the economic implication of errors—it may not have 
to be as stringent as the formal validation of banks’ risk models by internal validation 
teams and regulators. However, the process should establish validation standards and 
an ongoing monitoring program for the new model. The standards should account for 



the characteristics of machine-learning models, such as automatic updates of the 
algorithm whenever fresh data are captured. This is an area where most banks still 
need to develop appropriate validation and monitoring standards. If algorithms are 
updated weekly, for example, validation routines must be completed in hours and days 
rather than weeks and months. Yet it is also extremely important to put in place controls 
that alert users to potential sudden or creeping bias in fresh data. 

• A culture for continuous knowledge development. Institutions should invest in 

developing and disseminating knowledge on data science and business applications. 
Machine-learning applications should be continuously monitored for new insights and 
best practices, in order to create a culture of knowledge enhancement and to keep 
people informed of both the difficulties and successes that come with using such 
applications. 

Creating a conscious, standards-based system for developing machine-learning algorithms 
will involve leaders in many judgment-based decisions. For this reason, debiasing techniques 
should be deployed to maximize outcomes. An effective technique in this context is a 
“premortem” exercise designed to pinpoint the limitations of a proposed model and help 
executives judge the business risks involved in a new algorithm. 


Sometimes lost in the hype surrounding machine learning is the fact that artificial intelligence 
is as prone to bias as the real thing it emulates. The good news is that biases can be 
understood and managed—if we are honest about them. We cannot afford to believe in the 
myth of machine-perfected intelligence. Very real limitations to machine learning must be 
constantly addressed by humans. For businesses, this means the creation of incremental, 
insights-based value with the aid of well-monitored machines. That is a realistic algorithm for 
achieving machine-learning impact. 



The evolution of model risk 
management 


An increasing reliance on models, regulatory challenges, and talent 
scarcity is driving banks toward a model risk management organization 
that is both more effective and value-centric. 


T he number of models is rising dramatically—10 to 25 percent annually at large 

institutions—as banks utilize models for an ever-widening scope of decision making. 
More complex models are being created with advanced-analytics techniques, such as 
machine learning, to achieve higher performance standards. A typical large bank can now 
expect the number of models included within its model risk management (MRM) framework 
to continue to increase substantially. 

Among the model types that are proliferating are those designed to meet regulatory 
requirements, such as capital provisioning and stress testing. But importantly, many of the 
new models are designed to achieve business needs, including pricing, strategic planning, 
and asset-liquidity management. Big data and advanced analytics are opening new areas for 
more sophisticated models—such as customer relationship management or anti-money 
laundering and fraud detection. 


The promise and wider application of models have brought into focus the need for an efficient 
MRM function, to ensure the development and validation of high-quality models across the 
whole organization—eventually beyond risk itself. Financial institutions have already invested 





millions in developing and deploying sophisticated MRM frameworks. In analyzing these 
investments, we have discovered the ways that MRM is evolving and the best practices for 
building a systematically value-based MRM function (see sidebar, “Insights from 
benchmarking and MRM best practices”). This article summarizes our findings. 

Model risk and regulatory scrutiny 

The stakes in managing model risk have never been higher. When things go wrong, 
consequences can be severe. With digitization and automation, more models are being 
integrated into business processes, exposing institutions to greater model risk and 
consequent operational losses. The risk lies equally in defective models and model misuse. A 
defective model caused one leading financial institution to suffer losses of several hundred 
million dollars when a coding error distorted the flow of information from the risk model to the 
portfolio-optimization process. Incorrect use of models can cause as much (or greater) harm. 
A global bank misused a risk-hedging tool in a highly aggressive manner and, as a result, 
passed its value-at-risk limits for nearly a week. The bank eventually detected the risk, but 
because the risk model it used was inadequately governed and validated, it only adjusted 
control parameters rather than change its investment strategy. The consequent loss ran into 
the billions. Another global bank was found in violation of European banking rules and fined 
hundreds of millions of dollars after it misused a calculation model for counterparty-risk 
capital requirements. 

Events like these at top institutions have focused financial-industry attention on model risk. 
Supervisors on both sides of the Atlantic decided that additional controls were needed and 
began applying specific requirements for model risk management on banks and insurers. In 
April 2011, the US Board of Governors of the Federal Reserve System published the 
Supervisory Guidance on Model Risk Management (SR 11-7). This document provided an early 
definition of model risk that subsequently became standard in the industry: “The use of 
models invariably presents model risk, which is the potential for adverse consequences from 
decisions based on incorrect or misused model outputs and reports.” SR 11-7 explicitly 
addresses incorrect model outputs, taking account of all errors at any point from design 
through implementation. It also requires that decision makers understand the limitations of a 
model and avoid using it in ways inconsistent with the original intent. The European Banking 


Authority’s Supervisory Review and Evaluation Process, meanwhile, requires that model risk 




be identified, mapped, tested, and reviewed. Model risk is assessed as a material risk to 
capital, and institutions are asked to quantify it accordingly. If the institution is unable to 
calculate capital needs for a specific risk, then a comprehensible lump-sum buffer must be 
fixed. 

The potential value in mature MRM 

The value of sophisticated MRM extends well beyond the satisfaction of regulatory regimes. 
But how can banks ensure that their MRM frameworks are capturing this value thoroughly? 

To find the answer, we must first look more closely at the value at stake. Effective MRM can 
improve an institution’s earnings through cost reduction, loss avoidance, and capital 
improvement. Cost reduction and loss avoidance come mainly from increased operational and 
process efficiency in model development and validation, including the elimination of defective 
models. 

Capital improvement comes mainly from the reduction of undue capital buffers and add-ons. 
When supervisors feel an institution’s MRM is inadequate, they request add-ons. An improved 
MRM function that puts regulators in a more comfortable position leads to a reduction of 
these penalties. (The benefit is similar to remediation for noncompliance.) Capital inefficiency 
is also the result of excessive modeler conservatism. To deal with uncertainty, modelers tend 
to make conservative assumptions at different points in the models. The assumptions and 
attending conservatism are often implicit and not well documented or justified. The opacity 
leads to haphazard application of conservatism across several components of the model and 
can be costly. Good MRM and proper validation increases model transparency (on model 
uncertainties and related assumptions) and allows for better judgments from senior 
management on where and how much conservatism is needed. 

This approach typically leads to the levels of conservatism being presented explicitly, at 
precise and well-defined locations in models, in the form of overlays subject to management 
oversight. As a result, the total level of conservatism is usually reduced, as end users better 
understand model uncertainties and the dynamics of model outcomes. They can then more 
clearly define the most relevant mitigation strategies, including revisions of policies governing 
model use. 



Profit and loss 


With respect to improvement in profit and loss (P&L), MRM reduces rising modeling costs, 
addressing fragmented model ownership and processes caused by high numbers of complex 
models. This can save millions. At one global bank, the capital budget for models increased 
sevenfold in four years, rising from €7 million to €51 million. By gaining a better understanding 
of the model landscape, banks are able to align model investments with business risks and 
priorities. By reducing model risk and managing its impact, MRM can also reduce some P&L 
volatility. The overall effect heightens model transparency and institutional risk culture. The 
resources released by cost reductions can then be reallocated to high-priority decision¬ 
making models. 

Systematic cost reduction can only be achieved with an end-to-end approach to MRM. Such 
an approach seeks to optimize and automate key modeling processes, which can reduce 
model-related costs by 20 to 30 percent. To take one example, banks are increasingly 
seeking to manage the model-validation budget, which has been rising because of larger 
model inventories, increasing quality and consistency requirements, and higher talent costs. A 
pathway has been found in the industrialization of validation processes, which use lean 
fundamentals and an optimized model-validation approach. 

• Prioritization (savings: 30 percent). Models for validation are prioritized based on 
factors such as their importance in business decisions. Validation intensity is 
customized by model tiers to improve speed and efficiency. Likewise, model tiers are 
used to define the resource strategy and governance approach. 

• Portfolio-management office and supporting tools (savings: 25 percent). Inefficiency 
can be reduced at each stage of the validation process, with predefined processes, 
tools, and governance mechanisms. These include development and submission 
standards as well as validation plans and playbooks. 

• Testing and coding (savings: 25 percent). Automation of well-defined and repetitive 
validation tasks, such as standardized testing or model replication, can further lower 
costs. 



The evolution toward capturing value 
systematically 


To manage the P&L, capital, and regulatory challenges to their institutions’ advantage, leading 
banks are moving toward a robust MRM framework that deploys all available tools to capture 
efficiencies and value. The path to sophisticated model risk management is evolutionary—it 
can be usefully discussed as having three stages: building the elements of the foundation, 
implementing a robust MRM program, and capturing the value from it (Exhibit 1). 

Exhibit 1 


Model risk management has three evolutionary stages. 
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Most North American banks are in stage 2 of MRM evolution, while many 
European peers are still in stage 1. 


Building the foundational elements 





The initial phase is mainly about setting up the basic infrastructure for model validation. This 
includes the policies for MRM objectives and scope, the models themselves, and the 
management of model risk through the model life cycle. Further policies determine model 
validation and annual review. Model inventory is also determined, based on the defined 
characteristics of the model to be captured and a process to identify all models and 
nonmodels used in the bank. Reports for internal and external stakeholders can then be 
generated from the inventory. It is important to note, however, that the industry still has no 
standard of what should be defined as a model. Since banks differ on this basic definition, 
there are large disparities in model-inventory statistics. 

Governance and standards are also part of the MRM infrastructure. Two levels of governance 
are set up: one covering the steps of the model life cycle and one for the board and senior 
management. At this point, the MRM function will mainly consist of a small governance team 
and a team of validators. The governance team defines and maintains standards for model 
development, inventory, and validation. It also defines stakeholder roles, including skills, 
responsibilities, and the people who will fill them. The validation team conducts technical 
validation of the models. Most institutions build an MRM work-flow tool for the MRM 
processes. 

Implementing a robust program 

With foundational elements in place, banks can then build an MRM program that creates 
transparency for senior stakeholders on the model risk to the bank. Once model- 
development standards have been established, for example, the MRM program can be 
embedded across all development teams. Leading banks have created detailed templates for 
development, validation, and annual review, as well as online training modules for all 
stakeholders. They often use scorecards to monitor the evolution of model risk exposure 
across the institution. 

A fundamental objective is to ensure high-quality, prioritized submissions. Model submissions 
missing key components such as data, feeder models, or monitoring plans reduce efficiency 
and increase delivery time. Efficiency can be meaningfully enhanced if all submissions adhere 
to standards before the validation process begins. Models are prioritized based on their 
importance to the business, outcome of prior validation, and potential for regulatory scrutiny. 



Gaining efficiencies and extracting value 


In the mature stage, the MRM function seeks efficiencies and value, reducing the cost of 
managing model risk while ensuring that models are of the highest quality. In our survey of 
leading financial institutions, most respondents (76 percent) identified incomplete or poor 
quality of model submissions as the largest barrier for their validation timelines. Model 
owners need to understand the models they use, as they shall be responsible for errors in 
decisions based on those models. 

One of the best ways to improve model quality is with a center of excellence for model 
development, set up as an internal service provider on a pay-per-use basis. Centers of 
excellence enable best-practice sharing and advanced analytics across business units, 
capturing enterprise-wide efficiencies. The approach increases model transparency and 
reduces the risk of delays, as center managers apply such tools as control dashboards and 
checkpoints to reduce rework. 

Process automation defines MRM maturity, as model development, validation, and resource 
management are “industrialized” (Exhibit 2). Validation is led by a project-management office 
setting timelines, allocating resources, and applying model-submission standards. Models are 
prioritized according to their importance in business decisions. An onshore “validation 
factory” reviews, tests, and revises models. It can be supported by an offshore group for data 
validation, standards tests and sensitivity analysis, initial documentation, and review of model 
monitoring and reporting. The industrial approach to validation ensures that models across 
the organization attain the highest established standards and that the greatest value is 
captured in their deployment. 


Exhibit 2 


Industrialized model validation defines mature model 
risk management. 
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The standards-based approach to model inventory and validation enhances transparency 
around model quality. Process efficiency is also monitored, as key metrics keep track of the 
models in validation and the time to completion. The validation work-flow system improves 
the model-validation factory, whose enterprise-wide reach enables efficient resource 
deployment, with cross-team resource sharing and a clear view of validator capabilities and 
model characteristics. 

























Consistent standards for model planning and development allow institutions to develop more 
accurate models with fewer resources and in less time. In our experience, up to 15 percent of 
MRM resources can be conserved. Similarly, streamlining the model-validation organization 
can save up to 25 percent in costs. With the significant regulatory spending now being 
demanded of institutions on both sides of the Atlantic, these savings are not only welcome 
but also necessary. 


The contours of a mature stage of model risk management have only lately become clear. We 
now know where the MRM function has to go in order to create the most value amid costly 
and highly consequential operations. The sooner institutions get started in building value- 
based MRM on an enterprise-wide basis, the sooner they will be able to get ahead of the 
rising costs and get the most value from their models. 



The business logic in debiasing 


Debiasing business decision making has drawn board-level attention, as 
companies doing it are achieving marked performance improvements. 


A previous McKinsey article on the future of risk management in banking highlighted 
six structural trends that are expected to transform the risk function’s role in the 
coming decade. Of these, the trends relating to regulation, costs, customer expectations, 
analytics, and digitization are familiar, to one degree or another, to most readers. One trend 
that is less familiar is debiasing, that is, using insights from the fields of psychology and 
behavioral economics to help organizations take bias as much as possible out of risk 
decisions. 

Biases are predispositions of a psychological, sociological, or even physiological nature that 
can influence our decision making. They often operate subconsciously and by definition are 
outside the logical process on which decisions are purportedly based. While we may readily 
acknowledge their existence, we often believe that we ourselves are not prone to bias. (This is 
actually a form of bias in itself, called overconfidence.) 

The business world is scarcely immune, as executives have long suspected. In a survey of 
nearly 800 board members and chairpersons, McKinsey found that respondents ranked 
“reducing decision biases” as their number-one aspiration for improving performance. As a 
consequence, we have seen increasing numbers of companies provide training in 
unconscious biases and how they affect management actions, such as gender bias in 
personnel decisions. 




Bias is costly. Take the effect of one kind of bias, stability bias, in one dimension of business, 
capital allocation, as an example. McKinsey research has shown that companies that allocate 
capital dynamically—rebalancing regularly according to performance—return between 1.5 
and 3.9 percent more to shareholders than companies with more static and routinized 
budgeting. The study suggests that companies with dynamic capital allocation could grow 
twice as fast as those without it. Yet in a classic example of stability bias, we found a 90 
percent correlation in budget allocation year after year, for a 20-year period. The latest 
McKinsey research only underscores the relevance of these findings. A 2016 survey of nearly 
1,300 executives worldwide revealed that higher-performing companies more tightly link 
reallocation to performance and value creation, using rigorous bias-reducing principles. 

Sometimes companies question least the decisions affecting their core business, such as 
underwriting in banks and insurance companies. These decisions and their governing 
processes can be so deeply embedded in the institutional culture that they might not appear 
to be open to question—or even recognized as decisions. The failure to take debiasing 
actions in these areas means that most of the potential bottom-line impact from debiasing 
remains unaddressed. Yet companies can shape practical, targeted debiasing interventions 
and achieve tangible business benefits. These can be substantial. When debiasing high- 
frequency decisions such as those in credit or insurance underwriting, we have seen losses 
reduced by more than 25 percent. 

Diverse biases and business priorities 


Biases affect how we process information, make decisions, and construct strategies (see 
sidebar “An overview of business-relevant biases”). They do not, however, always work in the 
same direction nor are they equally distorting in all situations. Companies have so far tapped 
only a small part of the potential of debiasing in business contexts. One reason is that no 
ready formulas exist that address the many different biases and business contexts. But 
corporate efforts to diagnose biases and take debiasing actions can be very effective, 
especially when prioritized by business need. Prioritization involves zooming in on the handful 
of decisions with the greatest business impact and then, decision by decision, identifying the 
actions that will reduce or eliminate the biases that may be present. 






No summary account can reveal the full complexity of biases, which originate in diverse 
human cultures, complex social interactions, and the depths of the human psyche. Biases can 
be predominantly psychological or social in origin. The social dimension of biases includes all 
cultural and organizational behavior. McKinsey research has highlighted “continuous 
improvement” as an important aspect of corporate culture at successful companies. Yet this 
advantage, which fosters internal competitiveness and rewards entrepreneurial creativity, can 
trigger action biases that can lead to unneeded or even harmful actions. Product launches, for 
example, are often the upshot of action biases. Yet three out of four launches fail to meet 
revenue expectations and many result in significant losses to the company. 

Group psychological behavior produces some of the most powerful biases in business 
settings. Group dynamics can cause managers to sacrifice reasonable dissent to enhance 
their associations, maintain the favorable perceptions of others, and keep competitors at bay. 
They may recognize but choose to ignore flaws in the analyses and proposals of their allies, 
so these kinds of biases are not cognitive in nature—they do not relate, in other words, to the 
acquisition and assimilation of knowledge. Rather, they are generated by the group setting 
itself, in which managers almost consciously relinquish good logic as they compare and 
evaluate options for action. 

Approaching debiasing systematically 

Many good executives are aware of individual and organizational biases—yet awareness 
alone cannot overcome some biases, which can be embedded deep in our thought 
processes, almost like a childhood memory. Many would welcome a more systematic 
approach to debiasing business decisions, given prevailing levels of business and 
organizational complexity. 

Executives concerned with improving the quality of decision making in key areas often turn to 
training. Training is helpful to create demand for debiasing, but by itself cannot solve the 
problem. The biases are often too strong to be overcome through training exercises alone. 

The solution lies in designing an alternate decision process and selecting an effective 
debiasing strategy. The most effective strategy may not be the most obvious candidate, 
however, or the easiest to implement. 



The choice of debiasing approaches will differ based on the type and frequency of the 
decisions that are being debiased. Analytical tools can be very efficient in debiasing high- 
frequency decisions such as those involved in credit underwriting. Analytics play an important 
but different role in low-frequency decision processes, providing, for example, an objective 
fact base for committees making quarterly decisions on recalibrating credit-rating models. 
Finally, for some important but infrequent decisions—such as those relating to infrastructure 
spending, technology transformations, or M&A —there may be a lack of sufficient data for 
analytical tools to be applied. Here, debiasing can be conducted by imposing specific, 
structured elements in group discussions and group-based decisions (such as those in board 
committees) to detect and counter emerging biases. 

A systematic approach also requires a cultural change within the organization—one that 
creates demand for debiasing measures and adherence to them. Part of the cultural change 
involves bringing informal decision-making processes into the open by appropriately 
formalizing them, so that they may be subject to debiasing through explicit procedural 
changes. 

Debiasing high-frequency decisions 

In many business sectors, high-frequency decisions are often governed by formal processes. 
One of the most powerful techniques for debiasing process-based decision-making are 
statistical decision systems. These are advanced models designed to discover patterns and 
probabilities in large data sets. For many process-based activities, decisions can be largely 
automated using statistical algorithms such as regression analysis, decision trees, and more 
advanced machine-learning algorithms. These can generate valuable insights—discovering 
attractive customer subsegments within otherwise less promising segments and 
geographies, for example. 

Models are often designed to manage high-frequency process-based decisions. The 
decisions around calibrating the models, however, are low-frequency decisions and are not 
process based. Debiasing low-frequency decisions is discussed below, but it is important to 
remember that the development of algorithmic models entails many potentially idiosyncratic, 
bias-prone assumptions and decisions. Even well-constructed algorithms, when deployed on 
data sets full of biased observations and outcomes, can propagate and systematize biases. 



Designers and managers must therefore actively prevent their algorithmic models from 
becoming black boxes with baked-in biases. The models should be validated by an 
independent team and challenged in dialogue and discussions similar to those companies 
have when considering new policies. Their operation must be periodically observed and the 
output reviewed for bias: without such intervention, machine learning could perpetuate the 
biases we are trying to avoid or create new and unexpected distortions. 

Fortunately, analytics can also help diagnose the presence of biases. The presence of such 
biases as mental fatigue (sometimes called “ego depletion”) or anchoring can be tested 
statistically and the effectiveness of counterbalancing interventions validated. Simulation 
tools even allow this kind of debiasing to be conducted without experimenting with the “live 
object”—that is, without interfering with a company’s actual risk decisions. In commercial 
lending, for example, such tools allow risk officers and relationship managers to participate in 
simulations of specific risk decisions and base real improvements on outcomes. 


Not all high-frequency decisions can or should be automated by algorithms, however. To 
continue with the commercial-lending example, for larger commercial loans, a carefully 
debiased manual review of applications will add more value than a statistical algorithm. 
Algorithms cannot create an informed view on investment plans based on customer 
interviews or an analysis of regulatory changes pending in the legislature. The sidebar “The 
Qualitative Criteria Assessment” describes one approach to debiasing judgment in high- 
frequency decisions. 

Debiasing low-frequency decisions 

Low-frequency decisions, such as those governing large investments, M&A, or organizational 
and business transformations, are prone to many of the same biases as process-based high- 
frequency decisions. The debiasing of these high-stakes decisions proceeds along different 
lines, however. 

The techniques employed must first of all take place in an environment where decision 
makers readily recognize their own as well as others’ biases. Often enough, senior executives 
are prone to overconfidence when it comes to their own biases—they can see the bias in the 



actions of others but not in their own. Executives who learn to accept the signals of their own 
biases and correct for them make better and more effective decisions. 

On an organization-wide level, the very data that underlie a decision process can be flawed. 
Without conscious, systematic probing, data selection is prone to confirmation bias—the 
selection of information that would tend to confirm our own expectations and business goals. 
Data that contradict our intentions is prone to rejection as faulty. To understand the 
importance of selecting bias-free data—and indeed, of debiasing generally—we need only 
recall the failure of value-at-risk models in the financial crisis. Damage assessments often 
revealed that the assumptions and inputs for these models served to disguise rather than 
reveal portfolio risk. The rare model that—presciently—assigned hefty capital requirements to 
mortgage exposures was rejected as faulty. 

Pragmatic solutions 

The good news is that pragmatic solutions exist. Carefully chosen interventions can achieve a 
real difference in decision making. The use of a neutral fact base, for example, can anchor 
decisions in objective reference points. Mental processes can be reset to a bias-free state, 
using such techniques as destressing exercises and initial anonymous voting to reveal 
concerns without the impediment of groupthink effects. Another powerful approach is the 
premortem analysis: for important business decisions, alternative scenarios are thereby fully 
explored to reveal potential implications. (French law schools were pioneers of this technique, 
having for decades required students to write full briefs of equal length on both sides of a 
case.) 

Another debiasing technique is the formal challenger role, by which a devil’s advocate or 
independent observer confronts biasing behavior actively and explicitly. In some institutions, a 
formal devil’s advocate role is played by a team designated to challenge the main findings 
competitively. The effectiveness of this approach is however dependent on the alertness and 
competence of the chosen advocates. Confidential voting—often with the aid of commercially 
available tools—is a way to empower every participant to challenge the group free of any 
social pressure. 



Textual analysis can be a more systematic approach. It involves the review and often scoring 
of all evaluations pertinent to the topic and has been used in a variety of settings, including to 
evaluate gender bias. Many companies have introduced this (along with other debiasing 
procedures) into personnel decision making. 

Benchmarks are another means to promote neutral evaluations. For financial analysis of 
proposals, for example, a requirement that financial ratios be presented with peer 
comparisons can foster unbiased perspectives. As discussed in the sidebar on the Qualitative 
Criteria Assessment, suitably complete historical data can be an effective debiasing 
requirement for overcoming availability bias—the tendency to base judgments on only the 
most memorable or available details. 

In decision-making processes, several conflicting biases may arise. It will be important, 
therefore, to take the time to diagnose bias profiles and prioritize debiasing measures for 
implementation. A large utility company seeking to debias a megainvestment decision 
recently encountered competing biases that acted on each other, amplifying the distorting 
effects of each bias. Investment proposals often reflected action-oriented biases, while social 
and stability biases limited the degree to which the proposals were challenged in meetings. 

The company addressed the action bias with a vigorous premortem analysis as a mandatory 
element of investment proposals, while establishing a formal devil’s advocate role in 
committee discussions to counteract groupthink. 

Debiasing in action 

A typical debiasing process is a learning exercise for an organization. It can take many shapes 
and forms but has the following actions in common: 

• Diagnose. The actual biases affecting business decisions are discovered by analyzing 
recent and past individual or group decisions, especially those that have been criticized 
in hindsight as biased. A decision-conduct survey is taken to discover how decisions 
have been made: concerned individuals are interviewed by experts in behavioral 
science, who match the evidence with markers of specific biases. 



• Design. In the design phase, the key biases are matched with the best debiasing 
strategies in light of the organizational and process context. Many interventions are 
available for every kind of bias and bias combination. The selection of specific 
measures and how they should be tailored to fit the particular decision-making context 
can be worked out in an off-site event with executives, committee members, and 
experts. The special setting also helps build awareness for cultural change. In solution 
design, simplicity will be an important factor for success. Better decisions emerge from 
a small number of carefully targeted interventions against the most critical biases, 
rather than a grab-bag of “nice to have” best practices. 

• Implement. This phase involves pilots and other mechanisms that are designed to 
maintain debiasing momentum. Change champions can be established, possibly on a 
permanent basis, to lead this work across the organization and to develop the approach 
to measuring and monitoring outcomes and impact. 


In such areas as gender bias and hiring, many major organizations have already seen impact 
from debiasing. In certain settings, companies have begun to address the distorting effects of 
biases in business. In the financial sector, for example, regulatory concerns have inspired 
systematic debiasing, resulting in the three-lines-of-defense principle, model-validation 
exercises, and new accounting standards. 

Above all, debiasing has a compelling business logic. For some high-frequency decisions, its 
bottom-line impact is substantial and easily measured. In financial services, for example, 25 to 
35 percent credit-loss reductions have been achieved. The effects of debiasing on low- 
frequency decisions are not as easily measured, but executives in every sector should be 
aware of the value in more deeply probing such actions as M&A decisions and large 
investments. Ultimately, the best measure of debiasing’s effectiveness may be the greater 
confidence leadership develops in rejecting, modifying, or endorsing the company’s most 
important strategic choices. In a world of increasing volatility, where nimble decision making 
under uncertainty will increasingly become the main determinant of success, the value of 
such confidence is hard to overestimate. 



Risk analytics enters its prime 


All the ingredients are in place for unprecedented advances in risk 
analytics. Now it’s up to banks to capture the opportunities. 


W ith the rise of computing power and new analytical techniques, banks can now 
extract deeper and more valuable insights from their ever-growing mountains of 
data. And they can do it quickly, as many key processes are now automated (and many more 
soon will be). For risk departments, which have been using data analytics for decades, these 
trends present unique opportunities to better identify, measure, and mitigate risk. Critically, 
they can leverage their vast expertise in data and analytics to help leaders shape the strategic 
agenda of the bank. 

Banks that are leading the analytical charge are exploiting both internal and external data. 
Within their walls, these banks are integrating more of their data, such as transactional and 
behavioral data from multiple sources, recognizing their high value. They are also looking 
externally, where they routinely go beyond conventional structured information, such as 
credit-bureau reports and market information, to evaluate risks. They query unconventional 
sources of data (such as government statistics, customer data from utilities and supermarket 
loyalty cards, and geospatial data) and even new unstructured sources (such as chat and 
voice transcripts, customer rating websites, and social media). Furthermore, they are getting 
strong results by combining internal and external data sets in unique ways, such as by 
overlaying externally sourced map data on the bank’s transaction information to create a map 




of product usage by geography. Perhaps surprisingly, some banks in emerging markets are 
pioneering this work. This is possible because these banks are often building their risk 
database from scratch and sometimes have more regulatory latitude. 

The recent dramatic increases in computing power have allowed banks to deploy advanced 
analytical techniques at an industrial scale. Machine-learning techniques, such as deep 
learning, random forest, and XGBoost, are now common at top risk-analytics departments. 
The new tools radically improve banks’ decision models. And techniques such as natural- 
language processing and geospatial analysis expand the database from which banks can 
derive insights. 

These advances have allowed banks to automate more steps within currently manual 
processes—such as data capture and cleaning. With automation, straight-through processing 
of most transactions becomes possible, as well as the creation of reports in near real time. 
This means that risk teams can increasingly measure and mitigate risk more accurately and 
faster. 

The benefits—and challenges—of risk 
analytics 

Banks that are fully exploiting these shifts are experiencing a “golden age” of risk analytics, 
capturing benefits in the accuracy and reach of their credit-risk models and in entirely new 
business models. They are seeing radical improvement in their credit-risk models, resulting in 
higher profitability. For example, Gini coefficients of 0.75 or more in default prediction models 
are now possible. Exhibit 1 lays out the value that analytics can bring to these models. 




Exhibit 1 


Analytically enhanced credit models can improve banks’ 
returns in four ways. 


Higher interest income 
from loan business 

• Increase loan volume 
through sales cam¬ 
paigns, with lower 
turndown rate due to 
better customer prese¬ 
lection and cross-selling 

• Increase margin and 
loan volume by gradually 
introducing risk- 
differentiated offers (eg, 
packages or prices) and 
cross-selling of higher- 
margin products 


Typical impact , 1 % 



Lower sales and 
operating costs 

• Targeted and 
effective origina¬ 
tion process (eg, 
risk prescreening, 
policy prefilters) 

• More efficient 
underwriting 
process (eg, 
digital channels, 
risk-based differ¬ 
entiated process 
across products) 



Higher Greater 

revenues productivity 


1 1mpact not additive and depends on the bank’s portfolio. 


Reduction of 
relative risk costs 

• Better selection 
of risks, (eg, with 
combined risk 
scores, risk clus¬ 
tering of customer 
segments) 

• Improved risk 
monitoring and 
early warning 
across product 
categories 



Fewer loan 
losses 


Improved capital 
efficiency 

• Better calibra¬ 
tion and refine¬ 
ment of the 
models, leading 
to reduced 
risk-weighted 
assets 

• Better data 
cleanliness to 
accurately 
represent risk 
measures and 
mitigants 


10-15 

Fewer risk- 
weighted assets 


Some banks are expanding their risk models to new realms. A few have been able to 
automate the lending process end-to-end for their retail and SME segments. These banks 
have added new analytical tools to credit processes, including calculators for affordability or 
preapproval limits. With this kind of straight-through processing banks can approve up to 90 
percent of consumer loans in seconds, generating efficiencies of 50 percent and revenue 
increases of 5 to 10 percent. Recognizing the value in fast and accurate decisions, some 
banks are experimenting with using risk models in other areas as well. For example, one 
European bank overlaid its risk models on its marketing models to obtain a risk-profitability 
view of each customer. The bank thereby improved the return on prospecting for new revenue 
sources (and on current customers, too). 
















A few financial institutions at the leading edge are using risk analytics to fundamentally 
rethink their business model, expanding their portfolio and creating new ways of serving their 
customers. Santander UK and Scotiabank have each teamed up with Kabbage, which, using 
its own partnership with Celtic Bank, has enabled these banks to provide automated 
underwriting of small-business loans in the United Kingdom, Canada, and Mexico, using 
cleaner and broader data sets. Another leading bank has used its mortgage-risk model to 
provide a platform for real estate agents and others providing home-buying services. 

Realizing the potential 

For many banks the advantages of risk analytics remain but a promise. They see out-of-date 
technology, data that is difficult to clean, skill gaps, organizational problems, and unrelenting 
regulatory demands. The barriers seem insurmountable. Yet banks can get things moving with 
some deliberate actions (Exhibit 2). 



Exhibit 2 


Several factors keeping banks from realizing the potential 
promise of risk analytics should be reexamined. 


Strategic 

Perceived barrier 

A better way to think about it 

agenda 

G 

• Risk analytics is disconnected from 
business strategy and often seen as 
only a technology or regulatory- 
compliance initiative 

• Risk analytics is at the heart of many 
strategic topics (eg, digital, capital 
productivity, loan-book health, 
market entry) 

Data and 
technology 

• Unclean, unmatched data 
means waiting for that never- 
ending, “nearly complete” data 
transformation 

• The data available can generate 
high value, often in combination 
with external data 


• Technological landscape is so com¬ 
plex that a simplification and upgrade 
is required before doing anything 

• The “art of the possible” can 
produce high-value projects 

Skills and 
organization 

• IT group doesn’t have the authority 
to enforce data-management policies 

• The business can take responsibility 
for data quality, integrity, and access, 
supported by a strong IT organization 

u 

• Building analytics means hiring 
scarce, expensive data engineers 
and scientists 

• Banks can move quickly through 
inorganic growth and partnerships 

Regulations 

• Regulatory burden does not allow 
us to focus on anything else, 
including analytics 

Analytics business cases can 
tease out surprising synergies 
between regulatory needs and 
business aspirations 


• Regulators would not agree with 
use of advanced models and more 
advanced data 

• Sophisticated, value-generating 
models can be built even within 
constraints established by the Basel 
Committee and the European Union 

Change 

«S> 

Building a model is relatively easy 
and can be done any time 

Digital economy has “winner takes 
all” economics; first movers have a 
huge advantage 


Perhaps the most salient issue is that risk analytics is not yet on the strategic agenda. Bank 
leaders often don’t understand what is really at stake with risk analytics—at times because 
the analytics managers present highly complex solutions with a business case attached as an 
afterthought. Lagging banks miss out on the benefits, obviously, and also put other programs 
and activities at risk. Initiatives to grow revenue and optimize pricing can founder if imprecise 
risk assessment of customer segments leads to poor choices. In lending, when risk models 














underperform, banks often add business rules and policies as well as other manual 
interventions. But that inevitably degrades the customer experience, and it creates an 
opening for fintechs to capture market share through a better experience and more precise 
targeting. Taken to its logical conclusion, it is conceivable that banks might be relegated to 
“dumb pipes” that provide only financing. 

Some nimble risk groups are finding ways through these problems, however. Our analysis 
suggests these teams have six common behaviors: 

• Take it from the top, lifting risk analytics to the strategic agenda. For example, 4 out of 
10 strategic actions that HSBC Bank laid out in 2015 rely heavily on risk analytics. 

• Think big and apply analytics to every material decision. Capital One is well-known for 
applying analytics to every decision that it makes, even when hiring data scientists. 

• Go with what you have. If data is messy or incomplete, don’t wait for a better version or 
for a “data-lake nirvana.” Use the data you have, or find a way to complement it. When 
Banco Bilbao Vizcaya Argentaria (BBVA) wanted to lend to some clients but lacked 
information, it partnered with Destacame, a utility-data start-up, to provide data 
sufficient to support a way to underwrite the customers. 

• Accumulate skills quickly, through either rapid hiring or acquisitions and partnerships. 
Then retain your talent by motivating people with financial and nonfinancial incentives, 
such as compelling projects. Banks such as BBVA, HSBC, Santander, and Sberbank 
have launched funds of $100 million and more to acquire and partner with fintechs to 
add their market share, sophisticated technologies, and people. 

• Fail often to succeed, iterating quickly through a series of “minimum viable products” 
(MVPs) while also breaking down traditional organizational silos. One bank building a 
fully digital lending product went through six MVPs in just 16 weeks to get to a product 
it could roll out more broadly. 

• Use model validation to drive relentless improvement. Validation teams can be the 
source of many improvements to risk models, while preserving their independence. The 
key is for teams to style themselves as the guardian of model performance, rather than 
the traditional activity of merely examining models. 



If banks can master these elements, significant impact awaits. Risk analytics is not the entire 
answer. But as leading banks are discovering, it is worthwhile in itself, and it is also at the 
heart of many successful transformations, such as digital risk and the digitization of key 
processes such as credit underwriting. 

Risk-analytics leaders are creating analytic algorithms to support rapid and more accurate 
decision making to power risk transformations throughout the bank. The results have been 
impressive. An improvement in the Gini coefficient of one percentage point in a default 
prediction model can save a typical bank $10 million annually for every $1 billion in 
underwritten loans. Accurate data capture and well-calibrated models have helped a 
global bank reduce risk-weighted assets by about $100 billion, leading to the release of 
billions in capital reserves that could be redeployed in the bank’s growth businesses. 

Leveraging the six successful behaviors 

Nothing succeeds like success. The behaviors we have observed in successful risk-analytics 
groups provide the guidance. 

Take it from the top 

Stress testing and regulatory oversight following the 2008 financial crisis have vaulted risk 
management to the top of the management agenda. Nine years later, and after significant 
investment, most big banks have regained a handle on their risks and control of their 
regulatory relations. However, leading banks, recognizing the value from risk analytics, are 
keeping these programs at the top of their strategic plans, and top leaders are taking 
responsibility. 

Top management attention ensures commitment of sufficient resources and removal of any 
roadblocks—especially organizational silos, and the disconnected data sets that accompany 
these divides. Leaders can also keep teams focused on the value of high-priority use cases 
and encourage the use of cross-functional expertise and cross-pollination of advanced 
analytical techniques. Good ideas for applications arise at the front line, as people recognize 
changing customer needs and patterns, so banks must also build and maintain lines of 
communication. 





Think big and apply analytics 


For some time, analytics has played an important role in many parts of the bank, including risk, 
where a host of models—such as the PD, LGD, and EAD models used in the internal 
ratings-based approach to credit risk—are in constant use. What’s new is that the range of 
useful algorithms has greatly expanded, opening up dozens of new applications in the bank. 
Many small improvements to material decisions can really add up. An obvious example is 
algorithmic trading, which has transformed several businesses. Already by 2009, for example, 
it accounted for 73 percent of traded volume in cash equities. An expansion of automated 
credit decisions and monitoring has allowed banks to radically improve customer experience 
in residential mortgages and other areas. Banks in North and South America are using 
advanced-analytics models to predict the behavior of past-due borrowers and pair them with 
the most productive collections intervention. 

These and other important examples are shown in Exhibit 3. What’s important is that leading 
banks are putting analytics to work at every step of these and many other processes. Any 
time a decision needs to be made, these banks call on risk analytics to provide better 
answers. Even as they expand the applications of risk analytics, however, leading banks also 
recognize that they need to strengthen their model risk management to deal with inherent 
uncertainties within risk-analytics models, as these make up the largest share of risk-related 
decisions within banks. 



Exhibit 3 


Rapid innovation in eight use cases is powered by 
advanced analytics. 


Credit Description Use cases 
risk 


1 

Underwriting 

Make better underwriting decisions by using deep-learning algo¬ 
rithms to process vast amounts of data and more accurately quantify 
the risk of default 

2 

Credit-line 

management 

Reduce charge-off losses by offering an optimal line to each client 
that is determined by machine-learning algorithms using the latest 
information about the client (eg, credit score) and local market (eg, 
home values) 

3 

Opera¬ 
tions risk 

Collections 

Increase recoveries by making the right offer, at the right time, and 
through the right channel, with a recommendation engine and decision 
flow powered by 4 machine-learning algorithms 

4 

Payment 

fraud 

detection 

Identify and review high-risk payments before they are 
executed by using input from fraud investigators to tune powerful 
machine-learning algorithms that pinpoint the highest-risk transactions 

5 

Trading 

risk 

Anti-money 

laundering 

Quickly suspend money-laundering operations using a longitudinal 
view of payment pathways to identify the patterns most indicative 
of money laundering, and accelerate reviews with powerful investiga¬ 
tive tools 

CO 

Contract 

compliance 

Automate the extraction and storage of data from millions of 
trading contracts for regulatory compliance using leading-edge 
image-recognition and machine-learning algorithms 

7 

Model 

risk 

Trade 

surveillance 

Identify high-risk traders by monitoring their behavior with sophisti¬ 
cated natural language-processing algorithms that recognize themes 
in trader communications that are markers of conduct risk 


Model Apply rigorous and efficient model-validation processes for 

validation traditional and advanced models that meet regulatory expectations 
and adhere to industry benchmarks for model risk management 



Go with what you have 




























Messy, repetitive, and incomplete databases are a reality—but need not be an excuse. Rather 
than waiting for improvements in the quality, availability, and consistency of the bank’s 
systems and the data they produce, leading risk-analytics teams ask what can be done now. 
This might involve using readily available data in the bank to immediately build a core analytic 
module, onto which new modules are integrated as new data sources become available. 
Alternatively, integrating two or more of the data sets on hand can generate significant value. 
These approaches hasten new analytical models to market, while at the same time helping 
the bank gather information as it forms a credit relationship with customers. 

Furthermore, leading banks supplement their resources with external data—once they have 
established that this offers clear additional value. Some US fintechs, for example, obtain 
customer permission to comb financial data and create a sanitized database that banks can 
use to make accurate risk decisions based cash-flow patterns. A bank in Central America 
built a credit-approval system for unbanked customers based on data collected from 
supermarket loyalty cards. The bank used data such as frequency of shopping and the 
amount that customers typically spent per visit to estimate customers’ ability to repay debt. 
Even better for banks, many external data are free. In some markets, micromarket information 
such as house prices by postal code or employment by district is available, and can be mined 
for insights into creditworthiness of customers, especially small businesses. Conducting 
geospatial analytics on this information can also provide valuable insights (for example, 
proximity to a coffee-chain outlet would reveal foot traffic for a retail shop). Banks have also 
started analyzing unstructured data sets, such as news articles, feedback sites, and even 
social-network data. 

Leading banks apply two tests before acquiring external data: Will it add value, typically 
through combination with other data sets? And does it conform with the bank’s regulatory 
and risk policies? Consumer-protection regulations restrict the type of data that banks can 
use for risk-analytics applications, such as lending and product design. 

While the practices outlined here will yield fast impact from messy, repetitive, and incomplete 
databases, most banks would still benefit from establishing sound data governance in parallel 
(and sometimes are required to do so under data regulations such as BCBS 239). 


Accumulate skills quickly 



Strong risk-analytics teams use several roles to develop solutions and integrate them into 
business processes (Exhibit 4). 

Exhibit 4 


Strong risk-analytics teams are using these roles to develop 
solutions and integrate them into business processes. 


Structuring a strong risk-analytics team 



Data engineers & data scientists: 

These roles are already common. 
What is new is that they encom¬ 
pass new techniques beyond 
traditional statistics and econo¬ 
metrics. Analytics teams now use 
such methods as graph theory 
to analyze supply-chain risk or 
machine-learning to develop highly 
sensitive early warning systems. 


Translators: 

This new role requires 
a keen business sense 
and an understanding 
of the rationale behind 
the models. It also 
requires an entrepre¬ 
neurial spirit to promote 
risk analytics through¬ 
out the bank. 


Business leaders and 
experts: Business leaders 
and experts are also 
involved in developing 
solutions, taking responsi¬ 
bility for embedding the risk 
model in current practices. 


Recognizing that they might not have the time to build the whole arsenal of skills, leading 
banks have acquired companies, outsourced some analytical work, invested in fintechs, and 
entered into formal partnerships with analytic houses. JPMorgan Chase has partnered with 
OnDeck to lend to small businesses; Bank of America has committed $3 billion annually to 
f intech investment and joint innovation. Other leading banks have entered into partnerships 
with digital innovators to better understand customer behavior and risk profiles. Even when 
leading banks have acquired talent at scale in these ways, they still work to define roles and 
build skills in the risk-analytics team. 






Fail often to succeed, iterating quickly 


Speed is as important as completeness in realizing value from risk analytics. A winner-takes- 
all dynamic is emerging in the race to better serve customers. Banks, fintechs, and platform 
companies are getting better at locking in customers quickly with highly personalized and 
desirable offerings. The offerings are dependent on customer data, which get richer and 
deeper with every new development of risk-analytics capabilities. 

To reach and exceed the speed at which this race is moving, leading banks rely on quick, 
narrowly defined experiments designed to reveal the value (or the futility) of a particular 
hypothesis. When they succeed, they constitute a minimum viable product—something good 
enough to take to market, with the expectation that it will be soon improved. These 
experiments take weeks to conduct, rather than the more traditional months-long efforts 
commonly seen in risk-analytics functions (and that’s not even considering the validation 
process). One form such experiments have taken are “hackathons”—coding sessions with 
analysts and others that have produced promising applications in compressed time-frames. 

Use model validation to drive relentless 
improvement 

The banks that are developing a competitive edge through analytics constantly improve their 
current models, even as they build new ones. They make full use of their independent model- 
validation framework, moving beyond providing regulatory and statistical feedback on risk 
models every year to a more insightful and business-linked feedback loop. Validation 
departments can achieve this without losing their independence by changing from a mind-set 
of “examiners of models” to “guardians of model performance.” 

To introduce a degree of experimentation into model validation, leading banks incorporate 
business and model expertise into bursts of rapid development and testing, and accept that 
not all results will be as expected. In this way, the model benefits from a continual 360° 
review, rather than being buried in the risk-modeling team and understood only by the model 
owner. To be sure, as they do this work, banks must also respect regulatory constraints and 
explain to supervisors how they are utilizing advanced techniques. But leading institutions do 




not use regulatory oversight as an excuse not to move forward in an agile fashion. As shown 
by the multiple examples in this article, even large banks can make significant changes to 
improve outcomes and customer experience. 


Getting started 


We have outlined the reasons leading banks see considerable near-term promise in improved 
risk analytics, and the behaviors and principles that are distinguishing more successful 
players from the rest. This raises a logical question about what comes next: How can banks 
develop and execute a long-term bankwide risk-analytics strategy? While a full discussion is 
beyond the scope of this article, we see five immediate actions for the chief risk officer (CRO) 
to maximize the value of existing investments and prioritize new ones. These actions are all 
consistent with the six successful behaviors discussed above, but distilled into immediate 
high-payoff steps. 

• Assess the current portfolio of risk-analytics projects, assets, and investments, and 
take a hard look at any that cannot answer the following questions satisfactorily: 

o Is the initiative business-driven? Does it address one of the biggest business 
opportunities and define an analytics use case to deliver it? Or is the initiative a 
hammer looking for a nail? 

o Does the initiative have a clear plan for adoption and value capture? Or is it 
only a “model building” project? 

o Is the initiative structured to generate quick improvements as well as longer- 
term impact? 

• Make an inventory of your talent, teams, and operating model for each initiative. 
Success requires multidisciplinary co-located teams of data engineers, data scientists, 
translators, and business experts. Prioritize actions to find the talent you need, rather 
than stretching the talent you have to the point of ineffectiveness. 

• List your data and technology choke points—the weakest links in the system. Then 
determine the work-arounds you can develop to get high-priority initiatives moving 
(such as using external or alternative internal data or vendor solutions). Where no work¬ 
around is possible, ensure that precious resources do not lay idle waiting for resolution. 



• Explain what you are doing to senior leaders, including business heads, the chief 
operating officer, and the chief investment officer. Work with them as needed to adjust 
priorities and redirect the program, but then proceed full steam ahead. 

In our experience, risk leaders can take these steps quickly, given the right level of 
determination and focus. CROs should not hesitate to pull critical people into the exercise for 
a couple of weeks—it’s typically a worthwhile investment that pays off in the redirection of a 
much larger body of work toward maximum impact. 



A case study in combating bias 


Following several disappointing investments, the German electric utility 
RWE overhauled its decision-making processes. Learn how from the CFO 
who spearheaded the effort. 


T he Quarterly. Tell us a bit about the circumstances that motivated RWE’s management 
to undertake a broad debiasing operation. 

Bernhard Gunther: In the second half of the last decade, we spent more than €10 billion on 
big capital-expenditure programs and acquisitions in conventional power plants. In the 
business cases underlying these decisions, we were betting on the assumptions of ever-rising 
commodity prices, ever-rising power prices. We were not alone in our industry in hitting a kind 
of investment peak at that time. What we and most other peers totally underestimated was 
the turnaround in public sentiment toward conventional power generation—for example, the 
green transformation of the German energy system, and the technological progress in 
renewable generation and related production costs. These factors went in a completely 
opposite direction compared to our scenarios. 

Conventional power generation in continental Europe went through the deepest crisis the 
industry has ever seen. This ultimately led to the split of the two biggest German players in the 
industry, E.ON and RWE. Both companies separated their ailing conventional power- 
generation businesses from the rest of the company. 

The Quarterly. Was it difficult to convince members of the executive and supervisory boards 
to scrutinize your decision-making practices? 



Bernhard Gunther: Actually, it was the supervisory board asking, “Where has the 
shareholders’ money gone?” and we in the executive board wanted to learn our lessons from 
this experience as well. So we embarked on a postmortem analysis to understand what went 
wrong and why, by looking at a sample of these €10 billion investments. We asked ourselves, 
“Is there anything we could have done differently, and if so, how can we learn from this in the 
future?” The spirit of it was not about shaming and blaming, but about learning from our own 
mistakes. 

The Quarterly. What were the main contributing factors that you identified in your 
investigation? 

Bernhard Gunther: There were a few outright areas of managerial under-performance such 
as some time and cost overruns on the €10 billion investments, totally unrelated to external 
factors. There were also exogenous factors that were not in our base-case assumption but 
that should have been within our solution space—the most obvious being the political intent 
to push renewables into the market, which was publicly known at the time our investment 
decisions were made. There was also at least one unforeseeable factor—the Fukushima 
disaster. The German government reacted by rushing into a sudden exit from nuclear-power 
generation. Roughly half of the nuclear plants were switched off immediately, significantly 
shortening the economic lifetime of the remaining plants. But even if you discount for 
Fukushima, I think the ultimate end game wouldn’t have looked much different from today’s 
perspective; it just speeded the whole thing up. 

The Quarterly. As you analyzed the decision-making dynamics at work, what biases did you 
start to see? 

Bernhard Gunther: What became obvious is that we had fallen victim to a number of 
cognitive biases in combination. We could see that status quo and confirmation biases had 
led us to assume the world would always be what it used to be. Beyond that, we neglected to 
heed the wisdom of portfolio theory that you shouldn’t lay all your eggs in one basket. We not 
only laid them in the same basket, but also within a very short period of time—the last billion 
was committed before the construction period of the first billion had been finalized. If we had 
stretched this whole €10 billion program out over a longer period, say 10 or 15 years, we might 
still have lost maybe €1 billion or €2 billion but not the amount we incurred later. 



We also saw champion and sunflower biases, which are about hierarchical patterns and 
vertical power distance. Depending on the way you organize decision processes, when the 
boss speaks up first, the likelihood that anybody who’s not the boss will speak up with a 
dissenting opinion is much lower than if you, for example, have a conscious rule that the 
bigwigs in the hierarchy are the ones to speak up last, and you listen to all the other evidence 
before their opinion is offered. 

And we certainly overestimated our own abilities to deliver, due to a good dose of action- 
oriented biases like overconfidence and excessive optimism. Our industry, like many other 
capital-intensive ones, has had boom and bust cycles in investments. We embarked on a 
huge investment program with a whole generation of managers who hadn’t built a single 
power plant in their professional lives; there were just a few people left who could really 
remember how big investments were done. So we did something that the industry, by and 
large, hadn’t been doing on a large scale for 20 years. 

The Quarterly. On the sunflower bias, how far down in the organization do you think that 
went? Were people having a hard time getting past their superiors’ views just on the executive 
level, or all the way down? 

Bernhard Gunther: Our investigation revealed that it went much farther down, to almost all 
levels of our organizational hierarchy. For example, there was a feeling within the rank and file 
who produced the investment valuations for major decisions that certain scenarios were not 
desired—that you exposed yourself to the risk of being branded an eternal naysayer, or 
worse, when you pushed for more pessimistic scenarios. People knew that there were no 
debiasing mechanisms upstairs, so they would have no champion too if they were to suggest, 
for example, that if we looked at a “brilliant” new investment opportunity from a different 
angle, it might not look that brilliant anymore. 

The Quarterly. So, what kind of countermeasures did you put in place to tackle these cultural 
issues? 

Bernhard Gunther: We started a cultural-change program early on, with the arrival of our 
new CEO, to address our need for a different management mind-set in light of an increasingly 
uncertain future. A big component of that was mindfulness—becoming aware of not only your 
own cognitive patterns, but also the likely ones of the people you work with. We also sought 



to embed this awareness in practical aspects of our process. For example, we’ve now made it 
mandatory to list the debiasing techniques that were applied as part of any major proposal 
that is put before us as a board. 

It was equally important for us to start to create an atmosphere in which people are 
comfortable with a certain degree of conflict, where there is an obligation to dissent. This is 
not something I would say is part of the natural DNA of many institutions, including ours. 
We’ve found that we have to push it forward and safeguard it, because as soon as hierarchy 
prevails, it can be easily discouraged. 

So, for example, when making big decisions, we now appoint a devil’s advocate—someone 
who has no personal stake in the decision and is senior enough in the hierarchy to be as 
independent as possible, usually a level below the executive board. And nobody blames the 
devil’s advocate for making the negative case because it’s not necessary for them to be 
personally convinced; it’s about making the strongest case possible. People see that 
constructive tension brings us further than universal consent. 


The Quarterly. How did you roll all this out? 

Bernhard Gunther: There were two areas of focus. First, over a period of two years, we sent 
the top 300 of our company’s management to a two-week course, which we had self- 
assembled with external experts. The main thrust of this program was self-awareness: being 
more open to dissent, more open to a certain amount of controlled risk taking, more agile, as 
with rapid prototyping, and so forth. 

Then we also launched a training program for managers and experts, especially those 
involved in project work—for example, the financial controllers that have to run the models for 
big investment decisions. This was a combination of a training course, some desktop training 
you could do on your own, and some distributed materials. 

This program explicitly focused on debiasing. It started with these typical examples where you 
can show everybody how easily we fall into those cognitive traps, framing it not as a personal 
defect but as something that’s just there. Secondly, it emphasized that debiasing can be done 
much more easily within a group, because it’s a collective, conscious effort. And not some 
kind of empty ritual either. We taught very specific things that people could apply in their daily 
practices. For example, you can do a kind of premortem analysis and ask your team, “Imagine 



we are five years into the future, and this whole project we’re deciding on today has turned 
out to be a complete disaster. What could have happened in the meantime? What could have 
gone wrong?” This is something that we are now doing regularly on big projects, especially 
when there are uncertain environmental factors—whether macroeconomic, technological, 
ecological, or political. 

The Quarterly. Could you tell us about an example or two where you made a different 
decision as the result of debiasing practice, where it went the other way from what you initially 
thought was the right answer? 

Bernhard Gunther: Two examples immediately come to my mind. The first one came up in 
the middle of 2015, when it became obvious that our company was in a strategic deadlock 
with the power-generation business—the cash cow of the company for years but now with a 
broken business model. There was a growing awareness among senior management that 
trying to cure the crisis with yet another round of cost cutting might not be good enough, that 
we needed to consider more radical strategic options. We established a red team and a blue 
team to come up with different proposals, one staffed internally and one with externals. We 
wanted an unbiased view from the outside, from people who were not part of our company or 
industry; in this case, we brought in external people with backgrounds in investment banking. 

The internal team came up with the kind of solution that I think everybody was initially leaning 
toward, which was more incremental. And the external team came up with a more disruptive 
solution. But because it was consciously pitched as an independent view, everybody on the 
board took their time to seriously consider it with an open mind. It planted the seedling of the 
strategy that we adopted to split the company into two parts, which now, a good year later, 
has successfully concluded with the IPO of Innogy. If we hadn’t taken this approach, maybe 
months later or years later, somebody would have come up with a similar idea, but it wouldn’t 
have happened that fast, with that kind of momentum. 

The second example is a recent potential investment project in renewable energy that carried 
high reputational value for us, so there were emotional issues attached to winning the project. 
We were bidding for a wind park that was to be built, and the lowest bidder wins by offering 
the lowest electricity price. We knew it would be a very competitive auction for that project, 
and we had already decided in the run up to the decision making that we wanted to have a 
devil’s advocate involved. 



We had the project team make the case first in the board meeting. Then we had the devil’s 
advocate put forward analysis of the risk-return trade-offs. All of this was in written form, so 
everybody had to read it before the meeting. This certainly helped our discussion a lot and 
made it much easier to have a nonemotional debate around the critical issues. And we came 
out of it with a different and I think better decision than we would have if we had just taken the 
proposal of our internal project team at face value. 

The Quarterly. Now that these decision-making changes have taken hold, how do you see 
things running differently in the organization? 

Bernhard Gunther: Looking back at where we were three or four years ago, I’d say that this 
practice of awareness and debiasing has now become almost a part of our corporate 
decision-making DNA. But it’s something you have to constantly force yourself to practice 
again and again, because everyone at some point asks, “Do we really need to do it? Can’t we 
just decide?” It’s a very time-intensive process, which should be utilized only for the most 
important decisions of strategic relevance. About 30 percent of our board’s decisions fall into 
this category—for example, major resource-allocation decisions—and it’s similar elsewhere in 
the company. 

Also, people’s general awareness of the complex set of issues around cognitive biases has 
grown dramatically. Before this, things easily degenerated into blaming exercises going both 
ways. The naysayers were critiquing the others for wanting to push their pet projects. And the 
people promoting these projects were saying that the naysayers were just narrow-minded 
financial controllers who were destroying the company by eternally killing good business 
ideas. But now there’s more mutual respect for these different roles that are needed to 
ultimately come up with as good a decision outcome as possible. It’s not just about debiasing; 
it’s given us a common language. It’s now routine for somebody to say in a meeting, “I think we 
need some debiasing here.” And then everybody can agree to this without any need to get 
emotional. When in doubt, we just go through the process. 

The Quarterly: Do you have any recommendations for other senior leaders who might be 
reading this interview? 

Bernhard Gunther: I think when you read about these issues, it can seem a bit esoteric. You 
might say, “Well, maybe it’s just their problem, but not mine.” I think everyone should just do it; 
just start with it even on a pilot basis. You don’t have to start rolling it out across 1,000 people. 



You can start with your own board, with a few test examples, and see if you think it helps you. 
But if you do it, you have to do it right; you have to be serious about it. Looking back, there 
were a few key success factors for us. For one, top management has to set an example. 
That’s true of any kind of change, not just debiasing. If it’s not modeled at the very top, it’s 
unlikely to happen further down the hierarchy. Second, everyone has to be open to these 
ideas or it can be difficult to really make progress. At first glance, many of the tools might 
seem trivial to some, but we found them to have a very profound effect. 



Analytics in banking: Time to realize 
the value 


By establishing analytics as a true business discipline, banks can grasp the 
enormous potential. 


onsider three recent examples of the power of analytics in banking: 

• To counter a shrinking customer base, a European bank tried a number of retention 
techniques focusing on inactive customers, but without significant results. Then it 
turned to machine-learning algorithms that predict which currently active customers 
are likely to reduce their business with the bank. This new understanding gave rise to a 
targeted campaign that reduced churn by 15 percent. 

• A US bank used machine learning to study the discounts its private bankers were 
offering to customers. Bankers claimed that they offered them only to valuable ones 
and more than made up for them with other, high-margin business. The analytics 
showed something different: patterns of unnecessary discounts that could easily be 
corrected. After the unit adopted the changes, revenues rose by 8 percent within a few 
months. 

• A top consumer bank in Asia enjoyed a large market share but lagged behind its 
competitors in products per customer. It used advanced analytics to explore several 
sets of big data: customer demographics and key characteristics, products held, credit- 
card statements, transaction and point-of-sale data, online and mobile transfers and 




payments, and credit-bureau data. The bank discovered unsuspected similarities that 
allowed it to define 15,000 microsegments in its customer base. It then built a next- 
product-to-buy model that increased the likelihood to buy three times over. 

Results like these are the good news about analytics. But they are also the bad news. While 
many such projects generate eye-popping returns on investment, banks find it difficult to 
scale them up; the financial impact from even several great analytics efforts is often 
insignificant for the enterprise P&L Some executives are even concluding that while analytics 
may be a welcome addition to certain activities, the difficulties in scaling it up mean that, at 
best, it will be only a sideline to the traditional businesses of financing, investments, and 
transactions and payments. 

In our view, that’s shortsighted. Analytics can involve much more than just a set of discrete 
projects. If banks put their considerable strategic and organizational muscle into analytics, it 
can and should become a true business discipline. Business leaders today may only faintly 
remember what banking was like before marketing and sales, for example, became a 
business discipline, sometime in the 1970s. They can more easily recall the days when 
information technology was just six guys in the basement with an IBM mainframe. A look 
around banks today—at all the businesses and processes powered by extraordinary IT—is a 
strong reminder of the way a new discipline can radically reshape the old patterns of work. 
Analytics has that potential. 

Why? Three factors are coming together to kick off the coming heyday. First, consider 
advances in technologies. The availability of information is booming: in the past few years, the 
amount of meaningful data—true signal, not noise—has grown exponentially, while the size 
and cost of processors decreased. By 2020, about 1.7 megabytes a second of new 
information will be created for every human being on the planet. Businesses have opened 
their minds, freely adapting new analytical techniques that in the past might have been 
dismissed as too impractical and theoretical for the real world. 

And those techniques have improved radically. We are well past simple linear regressions— 
machine learning now features support vector machines, random forests, gradient boosting, 
and many other astonishing algorithms. Any company’s ability to perform these analytics has 
been significantly boosted by the exponential increase of computing power (which makes it 
possible to undertake, in just seconds, an analysis that in the past would have taken weeks) 
and by new data-storage technologies, such as Fladoop. 




Second, banks in many regions are under enormous economic pressure. Our latest research 
finds that of the top 500 institutions around the world, 54 percent are priced below book 
value. In 2014 we calculated that just 18 percent of banks captured all the value in the 
industry. Recognizing this reality, banks have tried all manner of improvements, especially 
digitization and cost cutting. But these moves have taken them only so far; something new is 
needed. 

Those digitization efforts underlie the third factor pushing analytics. Much of a typical bank is 
now digitized and throwing off data by the terabyte. A mostly manual bank would have serious 
difficulty using advanced analytics; at digital banks, the highways are already paved. 

Put it all together, and you get advanced analytics: industrial-scale solutions to exploit data 
for authentic business insights and vastly improved decision making. The tools are there; 
banks must now carry them forward into actions that can drive meaningful change. The 
canvas is as broad as a bank itself. Rich real-time data—numbers, yes, but also text, voice, 
and images—now exist for literally every action that customers make, every product that 
banks sell, and every process that banks use to deliver those products. In this article, we will 
explore the vast opportunities, as well as the problems of integration and scaling that keep 
banks from making analytics a coherent discipline. We will then suggest the strategic and 
organizational elements that banks need to realize the analytics dream. 

Ready for prime time 

As the saying goes, “The future is already here. It’s just not evenly distributed.” Banks—and 
companies in every other industry—are already deploying advanced analytics to move their 
businesses forward. We see three ways it can generate a meaningful increase in profits 
(Exhibit 1). 



Exhibit 1 


Three ways advanced analytics can generate an increase 
in profits. 


Boosting traditional P&L levers 



• Accelerating growth 

• Enhancing productivity 

• Improving risk control 



Finding new 
sources 
of growth 


Delivering 
the digital 
bank 


• Advanced analytics can help banks wring small improvements out of almost all their 
everyday activities, boosting the traditional P&L levers. Potential moves include the 
following: 

• Accelerating growth, even in an anemic environment. Deeper and more detailed 
profiles of customers, together with transactional and trading analytics, can improve 
the acquisition and retention of clients, as well as cross- and upselling. For example, 
one bank used credit-card transactional data (from both its own terminals and those of 
other banks) to develop offers that gave customers incentives to make regular 
purchases from one of the bank’s merchants. This boosted the bank’s commissions, 
added revenue for its merchants, and provided more value to the customer. 

• Enhancing productivity. Every banking process can become faster and more effective. 
Among other things, banks can use advanced analytics to provide faster and more 
accurate responses to regulatory requests and give teams analytics-enhanced 
decision support. One bank we know used machine learning to understand the way the 
characteristics of code affected a mainframe’s running time and the resulting costs; by 
optimizing the code, it cut them by 15 percent. Another bank used new algorithms to 
predict the cash required at each of its ATMs across the country, combining this with 
route-optimization techniques to save money. 









• Improving risk control. Banks can lower their risk costs through analytics-aided 
techniques, such as digital credit assessment, advanced early-warning systems, next- 
generation stress testing, and credit-collection analytics. The expense of compliance 
and control has soared in recent years, and banks can use analytics to get economic 
returns from their considerable investments. We estimate that G-SIBs can take out up 
to $1 billion a year in costs through a simplified portfolio of data repositories—building 
on work that most banks have already done—and through new analytics that produce 
more accurate regulatory reports and deliver them more quickly. D-SIBs can save up to 
$400 million annually. Further out, banks will be able to use analytics to reduce fraud 
losses. 

• A second vector of impact is the way that analytics can help deliver the promise of 
digital banks and offer a much better customer experience at a fraction of the current 
cost. In some regions up to 65 percent of customers now interact with their banks via 
multiple channels. Their paths through them are extraordinarily complex: they often 
start in one channel, perform intermediate steps in others, and finish in yet another— 
with plenty of pauses and information-gathering loops along the way. Successful 
digital banks deliver a truly seamless multichannel experience by gathering real-time 
data and using analytics to understand the customer and build the proper (and always 
consistent) journey view. 

• Finally, analytics can help banks find new sources of growth, and even new business 
models. Banks may be able to reap income from their data—for example, by sharing 
customer-analytics capabilities with new ecosystem partners, such as telecom 
companies or retailers. Taken to a logical but not implausible extreme, banks can use 
data and analytics to shape a new business model and out-fintech the fintechs. The 
bank as data company can sit at the center of a consumer ecosystem where the 
revenue pools include not just banking but also many other B2C and B2B businesses. 
Great analytics isn’t the only requirement here: banks must get many other things right 
to be relevant to and trusted by customers. But that can be done, and already more 
than a dozen leading banks are taking positive steps in this direction. 


Not without pitfalls 




In our recent survey, we found that almost every bank lists advanced analytics among its 
top five priorities. Most plan to invest further in these techniques. A few banks are already 
seeing the rewards. These leaders have built substantial foundations by establishing data 
lakes and centers of excellence and using machine-learning techniques. They and many 
others have spent hundreds of millions on their data (especially risk data) and on compliance. 
For them, advanced analytics is becoming a reflex action, with commensurate rewards of 
about €300 million in additional annual profit, on average. 

Most banks we surveyed, however, are struggling. A good many are “started but stuck”: they 
have invested significantly in data infrastructure (mostly as a result of regulation) and 
experimented with advanced-analytics techniques (mostly through specialized teams loosely 
connected to the corporate center). But the expected results have not arrived. A few banks 
have yet to begin. 

The started-but-stuck ones are running into a number of problems. At the highest level, their 
efforts remain unconnected and subscale; they have not yet tied together their disparate 
efforts into a single, unified business discipline. Tactically, we see banks making unforced 
errors such as these: 

• not quantifying the potential of analytics at a detailed level 

• not engaging business leaders early and to develop models that really solve their 
problems and that they trust and will use—not a “black box” 

• falling into the “pilot trap”: continually trying new experiments but not following through 
by fully industrializing and adopting them 

• investing too much up front in data infrastructure and data quality, without a clear view 
of the planned use or the expected returns 

• not seeking cooperation from businesses that protect rather than share their data 

• undershooting the potential—some banks just put a technical infrastructure in place 
and hire some data scientists, and then execute analytics on a project-by-project basis 

• not asking the right questions, so algorithms don’t deliver actionable insights 


Making it happen 



Avoiding the pitfalls and accessing the broad set of opportunities requires CEO leadership as 
banks develop two assets: a strategy for the transformation and a robust analytics 
organization to assist and empower the businesses as they learn to use analytics in their 
everyday work. (New technologies and tools are also necessary; see sidebar, “A quick take on 
the CIO agenda.”) 

Readers may notice something that’s missing from this list: setting the aspiration. That’s 
because we think every institution, unless its circumstances are extraordinary, should set the 
same aspiration: to establish analytics as a business discipline—the go-to tool for the 
thousands of decision makers across the bank. Earlier we mentioned analytics as a reflex. To 
extend the metaphor, analytics should resemble the human nervous system; every part of the 
body knows what to do when presented with certain stimuli. The big difference among banks 
will probably be the pace at which they can build and train their systems. Just as some parts 
of your brain are trained and some are not, banks will find that some nerve paths are already 
working well, while others must be laid down and taught how to react. 

There’s something else missing from our list of required assets: an additional $100 million or 
so of spending. Many bank leaders look at analytics and fear an outsized investment. That’s 
not unreasonable, since in recent years institutions have had to spend billions on things they 
could not have anticipated, and budgets are very thin. But analytics is not a bet-the-bank 
investment with no graceful exits; it’s a short-cycle flow of investments with lots of options to 
kill unsuccessful pilots. The small but immediate payoffs from the initial work can finance the 
next wave of projects, which in turn finance more and larger efforts. Once the system is built, 
the investment is over and the margins become enormous—like those of software or tech 
companies. 

A clear strategy centered on high-priority 
applications 

Three elements are essential to the strategy. First, banks need an analytics-ready mind-set. 
Analytics transforms everyday work in surprising ways, so leaders must open their minds to 
the possibilities. Our core beliefs about advanced analytics can help. 



Great analytics starts with high-value questions, not data. To guide the discovery 
process, ask what problem you want to solve and how much value the solution can 
create. Do not launch yourself into analysis for the sake of analysis or into intellectually 
interesting problems whose solutions are not actionable. 

The smallest edge can make the biggest difference. Advanced analytics is not about 
solving your biggest problems; it’s about solving hundreds of small ones that all add up. 
Especially in operations, these techniques can help to redefine processes and shorten 
them by several steps. 

Insights live at the boundaries between data sets. Remember the bank that combined 
six or seven discrete data sets to build a tool predicting the next product to buy? It 
realized that lots of relationships become apparent only when it compared widely 
varying parameters. Banks have massive amounts of data scattered through different 
departments. Pilots to bring together small samples of information can reveal the 
potential. 

Loops beat lines every time. Following a process can be a slog, and to do so you 
sometimes have to put on blinders. But that mentality is exactly wrong for advanced 
analytics. Banks that use feedback loops can not only be faster to market than 
competitors but also arrive there with better products. Ultimately, machines learn just 
as we do: by trial and error. 

Design matters. You want people to use your new tools. A beautiful algorithm deserves 
an attractive package that catches the eye of your users. Most of them can’t read code 
or understand the output of a model. To act on these insights, they need easily readied 
and used dashboards that help them make decisions and test potential scenarios. 

Analytics isn’t enough; adoption is essential. Use whatever means necessary- 
incentives, role modeling, communication, more communication—to get decision 
makers to use the new tools. Way too often, best-in-class algorithms sit idle in 
computers because users do not trust what they regard as a black box, fear the impact 
it could have on their roles, or simply do not want to go through the discomfort of 
change. Creating analytics is like putting jet fuel in your car. At the end of the day, if the 
driver does not develop the skills needed to drive faster, the effort is wasted. 



• Analytics is a team sport. The skills banks need to make analytics work cannot be 
contained within a single person—at least not yet. Your teams must include true experts 
on data science, engineering, data architecture, and design. Faking it with people who 
do a little bit of everything won’t work. 

A second element of the strategy is a set of prioritized use cases and a mechanism to create a 
pipeline of them. The scope for analytics is vast. Anywhere a bank uses rules of thumb or 
something is done “the way we’ve always done it,” analytics can probably make 
improvements. The CEO must lead the hunt for these issues and help prioritize them. 

Critically, at the beginning, the chosen use cases should not be limited to applications in 
which analytics could produce a substantial uptick in results; they should also include areas 
where scale can be increased quickly, to avoid the “pilot trap.” 

Most of the potential use cases are relevant to every banking business. They include 
commercial applications: cross-selling and upselling, customer acquisition, reducing churn, 
and winning back customers. Business-improvement levers (such as dynamic and value 
pricing, credit underwriting, sales-area planning, yield and claims management, fraud 
detection, call-center routing, and workforce planning) are also relevant for most banks. While 
the first couple of use cases can be introduced top-down or outside-in, it is just as important 
to encourage everybody in the bank to become creative and make suggestions—while always 
ensuring a clear path to creating value. To avoid discouragement, long validation and delivery 
cycles need to be shortened. Innovation labs can help accelerate the process. 

Finally, a strategy should set out a vision for how the bank will use analytics applications. For 
each use case the bank is considering, it should start by asking what problem holds back the 
business from having a greater impact. It can then work through a set of five steps: identifying 
the source of value, considering the available data (easier to do with a data lake, as we 
describe in the sidebar), identifying the analytics technique that will respond to the problem 
and probably produce insights, considering how to integrate analytics into the workflow of the 
business, and anticipating the problems of adoption (Exhibit 2). 
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Ensuring impact has five prerequisites. 
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Will sellers use the tools? If not, why not? What are their needs, and how can you make the 
analytical tools responsive to them? Sometimes the answer involves bundling insights from 
algorithms with useful data for sales managers in an app that they can use on external visits. 
Other times, a bank will have to change the way it develops campaigns and pushes them to 
the front line and to customers. Finally, in many other cases the bank will have to develop a 
group of high-performing champions who embrace this discipline and act as role models. 

Embedding analytics in the organization is not simply a matter of getting specific teams to use 
specific tools, though that’s essential. The CEO and the top team must do much more to 
communicate clearly that analytics is important to the bank and empower everyone to join the 
revolution. The classical steps of successful change management will be essential: role 
modeling the new behavior, clearly explaining why change is needed, building the skills of the 
businesses so they can succeed with the new tools, and reinforcing the bank’s commitment 
through formal mechanisms (such as incentives). 


A powerful analytics network 








The businesses will need help to design analytics systems, to build applications exploiting 
them, and to promote adoption. Banks will want to establish a central team that supports 
these needs. But the last thing they should do is build another silo. What they require is a 
networked structure, a kind of nervous system. More than anything, banks must have open 
channels and accessibility to make a knowledge of analytics pass freely throughout the 
enterprise. An analytics center of excellence, the spine of such a system, will probably need 
some or all of the following components: 

• New roles and responsibilities in data management, advanced analytics, and campaign 
execution. Perhaps the most critical role is that of a chief data officer responsible not 
only for analytics strategy and its integration into business units but also for defining 
data management’s roles and responsibilities, monitoring the quality of data, and 
ensuring regulatory compliance. 

• Imaginative channels, such as innovation labs, to bring analytics closer to users. 

• A deep pipeline of analytics talent, cited as a top priority by 60 percent of the banks in 
our recent survey. Banks should typically start with small teams of data scientists, who 
can work with external partners to absorb the necessary competences and skills, and 
then scale up gradually. 

• A clear governance plan with a strong center of excellence (headed by the chief data 
officer) and well-defined responsibilities for the governance and quality of data and for 
the execution of analytics within the businesses. 

• “Gold standard” data-managementprocesses that define clear accountability, maintain 
the quality of data, and manage metadata, the data life cycle, and controls. 

• Bulletproof data-quality controls, starting at the very beginning of the data life cycle. 
They should be automated wherever possible and monitored by a set of key quality 
indicators, so that the businesses are accountable for collecting the right data. 


More than 90 percent of the top 50 banks around the world are using advanced analytics. 
Most are having one-off successes but can’t scale up. Nonetheless, some leaders are 
emerging. Such banks invest in talent through graduate programs. They partner with firms 




that specialize in analytics and have committed themselves to making strategic investments 
to bolster their analytics capabilities. Within a couple of years, these leaders may be able 
develop a critical advantage. Where they go, others must follow—and the sooner the better 
because success will come, more than anything else, from real-world experience. 



Digital risk: Transforming risk 
management for the 2020s 


Significant improvements in risk management can be gained quickly 
through selective digitization—but capabilities must be test hardened 
before release. 


D igitization has become deeply embedded in banking strategy, as nearly all 

businesses and activities have been slated for digital transformations. The significant 
advantages of digitization, with respect to customer experience, revenue, and cost, have 
become increasingly compelling. The momentum to adopt the new technologies and 
operating models needed to capture these benefits continues to build. The risk function, 
which has seen significant growth in costs over the past decade, should be no exception. 
Indeed, we are starting to see digital transformations in risk create real business value by 
improving efficiency and the quality of risk decisions. A digitized risk function also provides 
better monitoring and control and more effective regulatory compliance. 

Experience shows that the structural changes needed to bring costs down and improve 
effectiveness in risk can be accomplished much like digital transformations in other parts of 
the bank. The distinguishing context of the risk environment, however, has important 
implications. First, risk practitioners in most regulatory jurisdictions have been under extreme 
pressure to meet evolving regulatory requirements and have had little time for much else. 
Second, chief risk officers have been wary of the test-and-learn approaches characteristic of 
digital transformation, as the cost of errors in the risk environment can be unacceptably high. 
As a result, progress in digitizing risk processes has been particularly slow. 



This status quo may be about to change, however, as global banking leaders begin to 
recognize how substantial value can be unlocked with a targeted digital agenda for risk 
featuring fit-for-purpose modular approaches. In addition to the objective of capturing value, 
this agenda incorporates risk-specific goals. These include ensuring the ongoing 
effectiveness of the control environment and helping the risk function apply technology to 
better address regulatory expectations in key areas—like risk measurement, aggregation, and 
reporting. 

What is digital risk? 

Digital risk is a term encompassing all digital enablements that improve risk effectiveness and 
efficiency—especially process automation, decision automation, and digitized monitoring and 
early warning. The approach uses work-flow automation, optical-character recognition, 
advanced analytics (including machine learning and artificial intelligence), and new data 
sources, as well as the application of robotics to processes and interfaces. Essentially, digital 
risk implies a concerted adjustment of processes, data, analytics and IT, and the overall 
organizational setup, including talent and culture. 

Three dimensions of change: Processes, 
data, organization 

To realize the full benefits of process and decision automation, banks need to ensure that 
systems, processes, and behaviors are appropriately fitted for their intended purpose. In the 
risk environment, prioritized use cases are isolated in such areas as credit underwriting, stress 
testing, operational risk, compliance, and control. In most banks, current processes have 
developed organically, without a clearly designed end state, so process flows are not always 
rational and efficient. Operational structures will need to be redesigned before automation 
and decision support can be accordingly enabled. 

Data, analytics, and IT architecture are the key enablers for digital risk management. Highly 
fragmented IT and data architectures cannot provide an efficient or effective framework for 
digital risk. A clear institutional commitment is thus required to define a data vision, upgrade 
risk data, establish robust data governance, enhance data quality and metadata, and build the 




right data architecture. Fortunately, processes and analytics techniques can now support 
these goals with modern technology in several key areas, including big data platforms, the 
cloud, machine learning, artificial intelligence, and natural-language processing. 

The organization and operating model will require new capabilities to drive rapid digitization. 
Although risk innovation takes place in a very specific, highly sensitive area, risk practitioners 
still need to create a robust culture of innovation. This means putting in place the right talent 
and nurturing an innovative “test and learn” mind-set. Governance processes must enable 
nimble responses to a fast-moving technological and regulatory environment. Managing this 
culture of innovation in a way that is appropriate for risk constitutes a key challenge for the 
digitized risk function. 

Adapting digital change to the risk 
context 


Most institutions are digitizing their risk functions at a relatively slow pace, taking modular 
approaches to targeted areas. A few have undertaken large-scale transformation, achieving 
significant and sustainable advances in both efficiency and effectiveness. Either way, in the 
risk context, care must be taken when adapting test-and-learn pilots commonly used in 
digital transformations in other parts of the bank. Robust controls must be applied to such 
pilots, as the tolerance for bugs and errors in risk is necessarily very low. When digitizing 
processes relating to comprehensive capital analysis and review (CCAR), for example, 
solutions cannot be introduced into production before thorough testing has convinced 
designers and practitioners of their complete reliability and effectiveness. In certain other risk 
areas—such as monitoring and early-warning systems in commercial credit risk—banks can 
use test-and-learn approaches effectively. 

Sizing the opportunity 

Our experience suggests that by improving the efficiency and effectiveness of current risk- 
management approaches, digital risk initiatives can reduce operating costs for risk activities 
by 20 to 30 percent. The state of risk management at most global, multiregional, and regional 



banks is abundant with opportunity. Current processes are resource intensive and 
insufficiently effective, as indicated by average annual fines above $400 million for 
compliance risk activities alone (Exhibit 1). 



Exhibit 1 


Digital risk management can significantly reduce losses and 
fines in core risk areas. 
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The greatest financial opportunities from digitization for both 
universal and regional banks are in the areas of operational 
and compliance risk 


Note: Credit risk losses are gross charge-offs; operational and compliance risk losses do 
not include opportunity costs (such as unearned revenue due to operational risk events); 
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The potential benefits of digital risk initiatives include efficiency and productivity gains, 
enhanced risk effectiveness, and revenue gains. The benefits of greater efficiency and 
productivity include possible cost reductions of 25 percent or more in end-to-end credit 
processes and operational risk, through deeper automation and analytics. Risk effectiveness 
can be strengthened with superior transparency, gained through better management and 
regulatory reporting and the greater accuracy of model outputs due to better data. Revenue 
lift can be achieved through better pricing or an enhanced customer and frontline experience 
—for example, by reducing the know-your-customer (KYC) cycle time from one week to under 
one day, or the mortgage-application process to under 30 minutes, from 10 to 12 days. 
Improved employee satisfaction can also be achieved through focusing talent on high-value 
activities. 

Target risk processes: Credit risk, stress 
testing, and operational risk and 
compliance 

The possible action areas for digital risk are extensive, but in our view three specific areas are 
optimal for near-term efforts: credit risk, stress testing, and operational risk and compliance. 
Alhough no one bank has fully digitized all three of these areas, we are seeing leading banks 
prioritize digital initiatives to realize discrete parts of the total savings available. The following 
discussion is based on actual digital risk initiatives across risk types and processes. 

Credit risk 

Credit delivery is hampered by manual processes for data collection, underwriting, and 
documentation, as well as data issues affecting risk performance and slow cycle times 
affecting the customer experience. Digital credit risk management uses automation, 
connectivity, and digital delivery and decision making to alleviate these pain points. Value is 
created in three ways: by protecting revenue, improving risk assessments, and reducing 
operational costs. 



To protect revenue in consumer credit, digital risk strengthens customer retention. It improves 
the customer experience with real-time decisions, self-service credit applications, and instant 
credit approvals. The improvements are enabled through integration with third parties for 
credit adjudication and the use of dynamic risk-adjusted pricing and limit setting. One 
European bank is exploring the potential for digital risk to expand revenue in consumer credit 
within the same risk appetite. Digitized credit processes will permit faster decision making 
than the competition while the bank maintains its superior risk assessment. 

Value is also created by improving risk assessment. Advanced analytics and machine-learning 
tools can increase the accuracy of credit risk models used for credit approvals, portfolio 
monitoring, and workouts. It can also reduce the frequency of judgment-based errors. The 
integration of new data sources enables better insights for credit decisions, while real-time 
data processing, reporting, and monitoring further improve overall risk-management 
capabilities. Operational costs are also reduced as credit processes are digitized. A greater 
share of time and resources can be dedicated to value-added activities, as inputs and outputs 
become standardized and paperless. 

In addition to improving default predictions, we have seen credit risk improvements in these 
areas creating a revenue lift of 5 to 10 percent and lowering costs by 15 to 20 percent (Exhibit 
2 ). 



Exhibit 2 


An integrated digital risk program for consumer credit can 
protect revenue, improve risk assessments, and reduce 
operational costs. 
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Banks find that significant value can be captured through a targeted digitization effort for 
stress testing, including CCAR. The current approach is highly manual, fragmented, and 
sequential, presenting challenges with data quality, aggregation, and reporting time frames 
and capacity. The processes are prime candidates for digital automation and work-flow tools. 

The underlying stress-testing process is the starting point. The improvement program will aim 
at optimizing resources. Dedication of resources will be prioritized based on materiality of risk. 
Institutions can achieve additional efficiency through parallel processing, centralization, and 
cross-training of staff, as well as better calendaring. Templates and outputs are standardized, 
and “golden” sources for data are designated. The resulting process becomes increasingly 
transparent and effective. Process optimization is supported by digital-automation initiatives 
for data loading, overlays, Y14A reports, and the end-to-end review and challenge process. 
Real-time visualization and sensitivity analysis are digitally enabled as part of the 
transformation. In addition to optimizing stress testing directly, banks are also looking for 
opportunities to harmonize the data, processes, and decision-making models with business 
planning. 

We have seen digitization in CCAR and stress testing bring significant cost improvements and 
—even more important—free up capacity so that experts can apply more insight and improve 
the quality and use of outputs (Exhibit 3). 



Exhibit 3 


There are many ways digitization can improve efficiency and 
effectiveness of comprehensive capital analysis and review 
(CCAR) and stress testing. 
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At many global banks, manual processes and fragmented systems have proliferated across 
operational risk and compliance controls and activities. In anti-money laundering (AML), for 
example, processes and data have become unwieldy, costs have skyrocketed, and efforts 
have become ineffective. Significant opportunities to increase the effectiveness and 
efficiency of AML operations lie in thorough end-to-end streamlining of the alert-generation 
and case-investigation processes. 

In alert generation, digital risk improvements ensure that reference data available for use in 
the analytic engine is of high quality. Advanced-analytics tools such as machine learning are 
used to test and refine the case-segmentation variables and support “auto-adjudication” 
where possible. In addition, digitization and work-flow tools can support smart investigations 
and automated filing of suspicious-activity reports, an improvement that enhances the 
productivity of the investigation units. 

Our experience of digital risk initiatives in AML is that they invariably improve effectiveness 
and efficiency, typically in the range of 20 to 25 percent. The overall impact of such 
improvement is even greater, however, given the large cost base of this function across 
institutions and the risk of not identifying bad actors. 

Digital risk is different 

A digital risk program must be designed in recognition of those aspects of the risk function 
that distinguish it from other functions, such as frontline digital sales. For risk, regulators will 
not accept the characteristic approaches of traditional digital transformations. Live launches 
of “minimum viable products” to be tested and refined in production is not an appropriate path 
for most risk activities. 

Most approaches to digitization focus on improving the customer experience. Digital risk will 
involve some actual external customers, such as in credit delivery, but in most areas the focus 
will be on internal customers, stakeholders, and regulators. Moreover, digital risk is never a 
self-contained effort—it will depend on data from all businesses and functions. Development 
thus proceeds at a pace limited by the careful management of these interdependencies. 
Innovative approaches such as agile and digital labs provide effective options to implement 
solutions incrementally. 



Direct impact will be felt in cost and risk 
reduction 


While digital risk offers clear opportunities for significant cost reduction, the impact on 
revenue is less obvious but implicitly understood by leaders. Frontline digital transformations 
are often aimed at direct revenue improvement; proof of this impact from digital risk programs 
is more elusive, since risk is an enabling function. Faster turnaround times for loan 
applications is a typical digital risk improvement. This will likely drive higher lending volumes 
and, consequently, increased revenue—even if the correlation cannot be precisely 
determined. Given the indirect impact on revenue, digital risk programs should focus primarily 
on reducing risk and cost. The exception is digital credit, where the case for revenue lift will be 
clearer. 

Designing a program 

An effective digital risk program begins with chief risk officers asking the right questions— 
those that point the institution toward specific initiatives for digital innovation. “Can we reduce 
the time needed for structured credit approvals to a few minutes?” “How can we increase 
straight-through processing rates?” “How can we improve the efficiency and streamlining of 
KYC activities to reduce pain points in the account-opening process?” “How can we make 
CCAR less sequential and resource intensive?” “How can we improve the timeliness of 
reporting to meet regulatory objectives?” “What value can we extract from better use of 
internal data?” “What is the incremental benefit of including new data sources?” The answers 
will help shape initiatives, which will be prioritized according to current resource-allocation 
levels, losses and regulatory fines, and implementation considerations, such as investment 
and time. 

Digital risk programs can incorporate the familiar design features of digital transformations, 
such as zero-based process and interface redesign and an agile framework. The testing and 
refinement, however, takes place entirely within a controlled environment. The design 
approach, which can be modular, must also be comprehensive, based on a thorough review of 
risk activities, appetite, and policies. 



The designs cannot be migrated into production until they have been thoroughly tested and 
syndicated, often with regulatory bodies. Because of its highly sensitive environment, risk is 
digitized end to end over a longer timeline than is seen in customer-service areas. Specific 
capabilities are developed to completion and released discretely, so that risk management 
across the enterprise is built incrementally, with short-term benefits. 

The anatomy of a transformation 

A digital risk program can get a running start by capturing high-value opportunities first. The 
anatomy of the transformation will resemble that of other digital transformations, with the 
usual three stages: 1) priority initiatives are identified according to the value at stake and the 
feasibility for near-term implementation, 2) digital solutions are designed to capture that value 
and tested and revised according to stakeholder input, and 3) the improvement is introduced 
into production, with continued capability building to embed the design, engineering, and 
change management into the operating model and invest in the right capabilities and mind¬ 
sets. 

The opportunities identified in stage one are matched in stage two with digital and other 
solutions that will reduce waste and optimize resources while improving standardization and 
quality. These solutions will involve work-flow automation, digital interfaces, and the use of 
advanced analytics and machine learning. The technology design may use a “two speed” 
architecture to support fast innovation in IT while allowing the main IT infrastructure to 
operate normally. New functionality is rigorously tested prior to migration into production, to 
ensure a smooth, error-free transition for critical risk functions. Iterative test-and-learn 
processes take place within environments featuring higher control standards than typical 
elsewhere. Stakeholder feedback and often regulator syndication are obtained prior to 
production release. 

In the third stage, where the innovation is introduced into production, the organization focuses 
on change management. In itself, this is no different from typical digitization programs in other 
business areas. The focus is on embedding the design into the operating model and 
continuing to invest in digital capabilities to build momentum for further launches. Having the 
right talent in place, whether drawn from internal or external sources, is the key to a 
successful transition to digital risk. 



The path to digital risk will be a multiyear journey, but financial institutions can begin to 
capture significant value within a few months, launching tailored initiatives for high-value 
targets. As the risk function becomes progressively digitized, it will be able to achieve higher 
levels of efficiency, effectiveness, and accuracy. In the future, risk management will be a lean 
and agile discipline, relieving cost pressures, improving regulatory compliance, and 
contributing to the bank’s ability to meet escalating competitive challenges. The first steps 
toward that future can be made today. 


Making data analytics work for you— 
instead of the other way around 


Does your data have a purpose? If not, you’re spinning your wheels. Here’s 
how to discover one and then translate it into action. 


T he data-analytics revolution now under way has the potential to transform how 
companies organize, operate, manage talent, and create value. That’s starting to 
happen in a few companies—typically ones that are reaping major rewards from their data— 
but it’s far from the norm. There’s a simple reason: CEOs and other top executives, the only 
people who can drive the broader business changes needed to fully exploit advanced 
analytics, tend to avoid getting dragged into the esoteric “weeds.” On one level, this is 
understandable. The complexity of the methodologies, the increasing importance of machine 
learning, and the sheer scale of the data sets make it tempting for senior leaders to “leave it to 
the experts.” 

But that’s also a mistake. Advanced data analytics is a quintessential business matter. That 
means the CEO and other top executives must be able to clearly articulate its purpose and 
then translate it into action—not just in an analytics department, but throughout the 
organization where the insights will be used. 

This article describes eight critical elements contributing to clarity of purpose and an ability to 
act. We’re convinced that leaders with strong intuition about both don’t just become better 
equipped to “kick the tires” on their analytics efforts. They can also more capably address 




many of the critical and complementary top-management challenges facing them: the need 
to ground even the highest analytical aspirations in traditional business principles, the 
importance of deploying a range of tools and employing the right personnel, and the 
necessity of applying hard metrics and asking hard questions. (For more on these, see 
“Straight talk about big data.” ) All that, in turn, boosts the odds of improving corporate 
performance through analytics. 

After all, performance—not pristine data sets, interesting patterns, or killer algorithms—is 
ultimately the point. Advanced data analytics is a means to an end. It’s a discriminating tool to 
identify, and then implement, a value-driving answer. And you’re much likelier to land on a 
meaningful one if you’re clear on the purpose of your data (which we address in this article’s 
first four principles) and the uses you’ll be putting your data to (our focus in the next four). 
That answer will of course look different in different companies, industries, and geographies, 
whose relative sophistication with advanced data analytics is all over the map. Whatever your 
starting point, though, the insights unleashed by analytics should be at the core of your 
organization’s approach to define and improve performance continually as competitive 
dynamics evolve. Otherwise, you’re not making advanced analytics work for you. 

‘Purpose-driven’ data 

“Better performance” will mean different things to different companies. And it will mean that 
different types of data should be isolated, aggregated, and analyzed depending upon the 
specific use case. Sometimes, data points are hard to find, and, certainly, not all data points 
are equal. But it’s the data points that help meet your specific purpose that have the most 
value. 

Ask the right questions 

The precise question your organization should ask depends on your best-informed priorities. 
Clarity is essential. Examples of good questions include “how can we reduce costs?” or “how 
can we increase revenues?” Even better are questions that drill further down: “How can we 
improve the productivity of each member of our team?” “How can we improve the quality of 
outcomes for patients?” “How can we radically speed our time to market for product 





development?” Think about how you can align important functions and domains with your 
most important use cases. Iterate through to actual business examples, and probe to where 
the value lies. In the real world of hard constraints on funds and time, analytic exercises rarely 
pay off for vaguer questions such as “what patterns do the data points show?” 

One large financial company erred by embarking on just that sort of open-ended exercise: it 
sought to collect as much data as possible and then see what turned up. When findings 
emerged that were marginally interesting but monetarily insignificant, the team refocused. 
With strong C-suite support, it first defined a clear purpose statement aimed at reducing time 
in product development and then assigned a specific unit of measure to that purpose, 
focused on the rate of customer adoption. A sharper focus helped the company introduce 
successful products for two market segments. Similarly, another organization we know 
plunged into data analytics by first creating a “data lake.” It spent an inordinate amount of time 
(years, in fact) to make the data pristine but invested hardly any thought in determining what 
the use cases should be. Management has since begun to clarify its most pressing issues. But 
the world is rarely patient. 

Had these organizations put the question horse before the data-collection cart, they surely 
would have achieved an impact sooner, even if only portions of the data were ready to be 
mined. For example, a prominent automotive company focused immediately on the 
foundational question of how to improve its profits. It then bore down to recognize that the 
greatest opportunity would be to decrease the development time (and with it the costs) 
incurred in aligning its design and engineering functions. Once the company had identified 
that key focus point, it proceeded to unlock deep insights from ten years of R&D history— 
which resulted in remarkably improved development times and, in turn, higher profits. 

Think really small. . . and very big 

The smallest edge can make the biggest difference. Consider the remarkable photograph 
below from the 1896 Olympics, taken at the starting line of the 100-meter dash. Only one of 
the runners, Thomas Burke, crouched in the now-standard four-point stance. The race began 
in the next moment, and 12 seconds later Burke took the gold; the time saved by his stance 



helped him do it. Today, sprinters start in this way as a matter of course—a good analogy for 
the business world, where rivals adopt best practices rapidly and competitive advantages are 
difficult to sustain. 



The variety of stances among runners in the 100-meter sprint at the first modern Olympic Games, held in Athens in 1896, is surprising to the modern viewer. Thomas Burke (second from left) is the only runner in 
the crouched stance—considered best practice today—an advantage that helped him win one of his two gold medals at the Games. 


The good news is that intelligent players can still improve their performance and spurt back 
into the lead. Easy fixes are unlikely, but companies can identify small points of difference to 
amplify and exploit. The impact of “big data” analytics is often manifested by thousands—or 
more—of incrementally small improvements. If an organization can atomize a single process 
into its smallest parts and implement advances where possible, the payoffs can be profound. 
And if an organization can systematically combine small improvements across bigger, multiple 
processes, the payoff can be exponential. 

Just about everything businesses do can be broken down into component parts. GE embeds 
sensors in its aircraft engines to track each part of their performance in real time, allowing for 
quicker adjustments and greatly reducing maintenance downtime. But if that sounds like the 
frontier of high tech (and it is), consider consumer packaged goods. We know a leading CPG 
company that sought to increase margins on one of its well-known breakfast brands. It 
deconstructed the entire manufacturing process into sequential increments and then, with 
advanced analytics, scrutinized each of them to see where it could unlock value. In this case, 
the answer was found in the oven: adjusting the baking temperature by a tiny fraction not only 
made the product taste better but also made production less expensive. The proof was in the 
eating—and in an improved P&L. 


When a series of processes can be decoupled, analyzed, and resynched together in a system 
that is more universe than atom, the results can be even more powerful. A large steel 
manufacturer used various analytics techniques to study critical stages of its business model, 
including demand planning and forecasting, procurement, and inventory management. In 
each process, it isolated critical value drivers and scaled back or eliminated previously 
undiscovered inefficiencies, for savings of about 5 to 10 percent. Those gains, which rested 
on hundreds of small improvements made possible by data analytics, proliferated when the 
manufacturer was able to tie its processes together and transmit information across each 
stage in near real time. By rationalizing an end-to-end system linking demand planning all the 
way through inventory management, the manufacturer realized savings approaching 50 
percent—hundreds of millions of dollars in all. 


Embrace taboos 


Beware the phrase “garbage in, garbage out”; the mantra has become so embedded in 
business thinking that it sometimes prevents insights from coming to light. In reality, useful 
data points come in different shapes and sizes—and are often latent within the organization, 
in the form of tree-text maintenance reports or PowerPoint presentations, among multiple 
examples. Too frequently, however, quantitative teams disregard inputs because the quality is 
poor, inconsistent, or dated and dismiss imperfect information because it doesn’t feel like 
“data.” 

But we can achieve sharper conclusions if we make use of fuzzier stuff. In day-to-day life— 
when one is not creating, reading, or responding to an Excel model—even the most hard-core 
“quant” processes a great deal of qualitative information, much of it soft and seemingly taboo 
for data analytics—in a nonbinary way. We understand that there are very few sure things; we 
weigh probabilities, contemplate upsides, and take subtle hints into account. Think about 
approaching a supermarket queue, for example. Do you always go to register four? Or do you 
notice that, today, one worker seems more efficient, one customer seems to be holding cash 
instead of a credit card, one cashier does not have an assistant to help with bagging, and one 
shopping cart has items that will need to be weighed and wrapped separately? All this is soft 
“intel,” to be sure, and some of the data points are stronger than others. But you’d probably 
consider each of them and more when you decided where to wheel your cart. Just because 
line four moved fastest the last few times doesn’t mean it will move fastest today. 



In fact, while hard and historical data points are valuable, they have their limits. One company 
we know experienced them after instituting a robust investment-approval process. 
Understandably mindful of squandering capital resources, management insisted that it would 
finance no new products without waiting for historical, provable information to support a 
projected ROI. Unfortunately, this rigor resulted in overly long launch periods—so long that 
the company kept mistiming the market. It was only after relaxing the data constraints to 
include softer inputs such as industry forecasts, predictions from product experts, and social- 
media commentary that the company was able to get a more accurate feel for current market 
conditions and time its product launches accordingly. 

Of course, Twitter feeds are not the same as telematics. But just because information may be 
incomplete, based on conjecture, or notably biased does not mean that it should be treated as 
“garbage.” Soft information does have value. Sometimes, it may even be essential, especially 
when people try to “connect the dots” between more exact inputs or make a best guess for 
the emerging future. 

To optimize available information in an intelligent, nuanced way, companies should strive to 
build a strong data provenance model that identifies the source of every input and scores its 
reliability, which may improve or degrade over time. Recording the quality of data—and the 
methodologies used to determine it—is not only a matter of transparency but also a form of 
risk management. All companies compete under uncertainty, and sometimes the data 
underlying a key decision may be less certain than one would like. A well-constructed 
provenance model can stress-test the confidence for a go/no-go decision and help 
management decide when to invest in improving a critical data set. 


Connect the dots 


Insights often live at the boundaries. Just as considering soft data can reveal new insights, 
combining one’s sources of information can make those insights sharper still. Too often, 
organizations drill down on a single data set in isolation but fail to consider what different data 
sets convey in conjunction. For example, FIR may have thorough employee-performance 
data; operations, comprehensive information about specific assets; and finance, pages of 
backup behind a P&L. Examining each cache of information carefully is certainly useful. But 
additional untapped value may be nestled in the gullies among separate data sets. 



One industrial company provides an instructive example. The core business used a state-of- 
the-art machine that could undertake multiple processes. It also cost millions of dollars per 
unit, and the company had bought hundreds of them—an investment of billions. The machines 
provided best-in-class performance data, and the company could, and did, measure how 
each unit functioned over time. It would not be a stretch to say that keeping the machines up 
and running was critical to the company’s success. 

Even so, the machines required longer and more costly repairs than management had 
expected, and every hour of downtime affected the bottom line. Although a very capable 
analytics team embedded in operations sifted through the asset data meticulously, it could 
not find a credible cause for the breakdowns. Then, when the performance results were 
considered in conjunction with information provided by HR, the reason for the subpar output 
became clear: machines were missing their scheduled maintenance checks because the 
personnel responsible were absent at critical times. Payment incentives, not equipment 
specifications, were the real root cause. A simple fix solved the problem, but it became 
apparent only when different data sets were examined together. 


From outputs to action 


One visual that comes to mind in the case of the preceding industrial company is that of a 
Venn Diagram: when you look at 2 data sets side by side, a key insight becomes clear through 
the overlap. And when you consider 50 data sets, the insights are even more powerful—if the 
quest for diverse data doesn’t create overwhelming complexity that actually inhibits the use 
of analytics. To avoid this problem, leaders should push their organizations to take a 
multifaceted approach in analyzing data. If analyses are run in silos, if the outputs do not work 
under real-world conditions, or, perhaps worst of all, if the conclusions would work but sit 
unused, the analytics exercise has failed. 

Run loops, not lines 

Data analytics needs a purpose and a plan. But as the saying goes, “no battle plan ever 
survives contact with the enemy.” To that, we’d add another military insight—the OODA loop, 
first conceived by US colonel John Boyd: the decision cycle of observe, orient, decide, and 



act. Victory, Boyd posited, often resulted from the way decisions are made; the side that 
reacts to situations more quickly and processes new information more accurately should 
prevail. The decision process, in other words, is a loop or—more correctly—a dynamic series 
of loops (exhibit). 



Exhibit 



Best-in-class organizations continually test their assumptions, 
processing new information more accurately and reacting to 
situations more quickly. 
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Best-in-class organizations adopt this approach to their competitive advantage. Google, for 
one, insistently makes data-focused decisions, builds consumer feedback into solutions, and 
rapidly iterates products that people not only use but love. A loops-not-lines approach works 
just as well outside of Silicon Valley. We know of a global pharmaceutical company, for 
instance, that tracks and monitors its data to identify key patterns, moves rapidly to intervene 
when data points suggest that a process may move off track, and refines its feedback loop to 
speed new medications through trials. And a consumer-electronics OEM moved quickly from 
collecting data to “doing the math” with an iterative, hypothesis-driven modeling cycle. It first 
created an interim data architecture, building three “insights factories” that could generate 
actionable recommendations for its highest-priority use cases, and then incorporated 
feedback in parallel. All of this enabled its early pilots to deliver quick, largely self-funding 
results. 

Digitized data points are now speeding up feedback cycles. By using advanced algorithms 
and machine learning that improves with the analysis of every new input, organizations can 
run loops that are faster and better. But while machine learning very much has its place in any 
analytics tool kit, it is not the only tool to use, nor do we expect it to supplant all other 
analyses. We’ve mentioned circular Venn Diagrams; people more partial to three-sided 
shapes might prefer the term “triangulate.” But the concept is essentially the same: to arrive 
at a more robust answer, use a variety of analytics techniques and combine them in different 
ways. 

In our experience, even organizations that have built state-of-the-art machine-learning 
algorithms and use automated looping will benefit from comparing their results against a 
humble univariate or multivariate analysis. The best loops, in fact, involve people and 
machines. A dynamic, multipronged decision process will outperform any single algorithm- 
no matter how advanced—by testing, iterating, and monitoring the way the quality of data 
improves or degrades; incorporating new data points as they become available; and making it 
possible to respond intelligently as events unfold. 


Make your output usable—and beautiful 



While the best algorithms can work wonders, they can’t speak for themselves in boardrooms. 
And data scientists too often fall short in articulating what they’ve done. That’s hardly 
surprising; companies hiring for technical roles rightly prioritize quantitative expertise over 
presentation skills. But mind the gap, or face the consequences. One world-class 
manufacturer we know employed a team that developed a brilliant algorithm for the options 
pricing of R&D projects. The data points were meticulously parsed, the analyses were 
intelligent and robust, and the answers were essentially correct. But the organization’s 
decision makers found the end product somewhat complicated and didn’t use it. 

We’re all human after all, and appearances matter. That’s why a beautiful interface will get you 
a longer look than a detailed computation with an uneven personality. That’s also why the 
elegant, intuitive usability of products like the iPhone or the Nest thermostat is making its way 
into the enterprise. Analytics should be consumable, and best-in-class organizations now 
include designers on their core analytics teams. We’ve found that workers throughout an 
organization will respond better to interfaces that make key findings clear and that draw 
users in. 

Build a multiskilled team 

Drawing your users in—and tapping the capabilities of different individuals across your 
organization to do so—is essential. Analytics is a team sport. Decisions about which analyses 
to employ, what data sources to mine, and how to present the findings are matters of human 
judgment. 

Assembling a great team is a bit like creating a gourmet delight—you need a mix of fine 
ingredients and a dash of passion. Key team members include data scientists, who help 
develop and apply complex analytical methods; engineers with skills in areas such as 
microservices, data integration, and distributed computing; cloud and data architects to 
provide technical and systemwide insights; and user-interface developers and creative 
designers to ensure that products are visually beautiful and intuitively useful. You also need 
“translators”—men and women who connect the disciplines of IT and data analytics with 
business decisions and management. 



In our experience—and, we expect, in yours as well—the demand for people with the 
necessary capabilities decidedly outstrips the supply. We’ve also seen that simply throwing 
money at the problem by paying a premium for a cadre of new employees typically doesn’t 
work. What does is a combination: a few strategic hires, generally more senior people to help 
lead an analytics group; in some cases, strategic acquisitions or partnerships with small data- 
analytics service firms; and, especially, recruiting and reskilling current employees with 
quantitative backgrounds to join in-house analytics teams. 

We’re familiar with several financial institutions and a large industrial company that pursued 
some version of these paths to build best-in-class advanced data-analytics groups. A key 
element of each organization’s success was understanding both the limits that any one 
individual can be expected to contribute and the potential that an engaged team with 
complementary talents can collectively achieve. On occasion, one can find “rainbow unicorn” 
employees who embody most or all of the needed capabilities. It’s a better bet, though, to 
build a collaborative team comprising people who collectively have all the necessary skills. 

That starts, of course, with people at the “point of the spear”—those who actively parse 
through the data points and conduct the hard analytics. Over time, however, we expect that 
organizations will move to a model in which people across functions use analytics as part of 
their daily activities. Already, the characteristics of promising data-minded employees are not 
hard to see: they are curious thinkers who can focus on detail, get energized by ambiguity, 
display openness to diverse opinions and a willingness to iterate together to produce insights 
that make sense, and are committed to real-world outcomes. That last point is critical 
because your company is not supposed to be running some cool science experiment 
(however cool the analytics may be) in isolation. You and your employees are striving to 
discover practicable insights—and to ensure that the insights are used. 

Make adoption your deliverable 

Culture makes adoption possible. And from the moment your organization embarks on its 
analytics journey, it should be clear to everyone that math, data, and even design are not 
enough: the real power comes from adoption. An algorithm should not be a point solution— 



companies must embed analytics in the operating models of real-world processes and day- 
to-day work flows. Bill Klem, the legendary baseball umpire, famously said, “It ain’t nothin’ 
until I call it.” Data analytics ain’t nothin’ until you use it. 

We’ve seen too many unfortunate instances that serve as cautionary tales—from detailed 
(and expensive) seismology forecasts that team foremen didn’t use to brilliant (and amazingly 
accurate) flight-system indicators that airplane pilots ignored. In one particularly striking case, 
a company we know had seemingly pulled everything together: it had a clearly defined 
mission to increase top-line growth, robust data sources intelligently weighted and mined, 
stellar analytics, and insightful conclusions on cross-selling opportunities. There was even an 
elegant interface in the form of pop-ups that would appear on the screen of call-center 
representatives, automatically triggered by voice-recognition software, to prompt certain 
products, based on what the customer was saying in real time. Utterly brilliant—except the 
representatives kept closing the pop-up windows and ignoring the prompts. Their pay 
depended more on getting through calls quickly and less on the number and type of products 
they sold. 

When everyone pulls together, though, and incentives are aligned, the results can be 
remarkable. For example, one aerospace firm needed to evaluate a range of R&D options for 
its next-generation products but faced major technological, market, and regulatory 
challenges that made any outcome uncertain. Some technology choices seemed to offer 
safer bets in light of historical results, and other, high-potential opportunities appeared to be 
emerging but were as yet unproved. Coupled with an industry trajectory that appeared to be 
shifting from a product- to service-centric model, the range of potential paths and complex 
“pros” and “cons” required a series of dynamic—and, of course, accurate—decisions. 

By framing the right questions, stress-testing the options, and, not least, communicating the 
trade-offs with an elegant, interactive visual model that design skills made beautiful and 
usable, the organization discovered that increasing investment along one R&D path would 
actually keep three technology options open for a longer period. This bought the company 
enough time to see which way the technology would evolve and avoided the worst-case 
outcome of being locked into a very expensive, and very wrong, choice. One executive likened 
the resulting flexibility to “the choice of betting on a horse at the beginning of the race or, for a 
premium, being able to bet on a horse halfway through the race.” 



It’s not a coincidence that this happy ending concluded as the initiative had begun: with senior 
management’s engagement. In our experience, the best day-one indicator for a successful 
data-analytics program is not the quality of data at hand, or even the skill-level of personnel in 
house, but the commitment of company leadership. It takes a C-suite perspective to help 
identify key business questions, foster collaboration across functions, align incentives, and 
insist that insights be used. Advanced data analytics is wonderful, but your organization 
should not be working merely to put an advanced-analytics initiative in place. The very point, 
after all, is to put analytics to work for you. 



The age of analytics: Competing in a 
data-driven world 


Big data’s potential just keeps growing. Taking full advantage means 
companies must incorporate analytics into their strategic vision and use it 
to make better, faster decisions. 


I s big data all hype? To the contrary: earlier research may have given only a partial view 
of the ultimate impact. A new report from the McKinsey Global Institute (MGI), The age of 
analytics: Competing in a data-driven world, suggests that the range of applications and 
opportunities has grown and will continue to expand. Given rapid technological advances, the 
question for companies now is how to integrate new capabilities into their operations and 
strategies—and position themselves in a world where analytics can upend entire industries. 

A 2011 MGI report highlighted the transformational potential of big data. Five years later, we 
remain convinced that this potential has not been oversold. In fact, the convergence of several 
technology trends is accelerating progress. The volume of data continues to double every 
three years as information pours in from digital platforms, wireless sensors, virtual-reality 
applications, and billions of mobile phones. Data-storage capacity has increased, while its 
cost has plummeted. Data scientists now have unprecedented computing power at their 
disposal, and they are devising algorithms that are ever more sophisticated. 




Earlier, we estimated the potential for big data and analytics to create value in five specific 
domains. Revisiting them today shows uneven progress and a great deal of that value still on 
the table (exhibit). The greatest advances have occurred in location-based services and in US 
retail, both areas with competitors that are digital natives. In contrast, manufacturing, the EU 
public sector, and healthcare have captured less than 30 percent of the potential value we 
highlighted five years ago. And new opportunities have arisen since 2011, further widening the 
gap between the leaders and laggards. 



Exhibit 


Progress in capturing value from data and analytics has 
been uneven. 


% of value captured 


Location-based data 



Major barriers 


• Penetration of GPS-enabled 
smartphones globally 


US retail 1 



• Lack of analytical talent 

• Siloed data within companies 


Manufacturing 2 



• Siloed data in legacy IT systems 

• Leadership skeptical of impact 


EU public sector 3 


US healthcare 



10 - 20 % 


• Lack of analytical talent 

• Siloed data within different agencies 


• Need to demonstrate clinical 
utility to gain acceptance 

• Interoperability and data sharing 


Similar observations hold true for EU retail sector. 

Manufacturing levers are divided by functional application. 

3 Similar observations hold true for other high-income-country governments. 




Leading companies are using their capabilities not only to improve their core operations but 
also to launch entirely new business models. The network effects of digital platforms are 
creating a winner-take-most situation in some markets. The leading firms have remarkably 
deep analytical talent taking on various problems—and they are actively looking for ways to 
enter other industries. These companies can take advantage of their scale and data insights 
to add new business lines, and those expansions are increasingly blurring traditional sector 
boundaries. 

Where digital natives were built for analytics, legacy companies have to do the hard work of 
overhauling or changing existing systems. Adapting to an era of data-driven decision making 
is not always a simple proposition. Some companies have invested heavily in technology but 
have not yet changed their organizations so they can make the most of these investments. 
Many are struggling to develop the talent, business processes, and organizational muscle to 
capture real value from analytics. 

The first challenge is incorporating data and analytics into a core strategic vision. The next 
step is developing the right business processes and building capabilities, including both data 
infrastructure and talent. It is not enough simply to layer powerful technology systems on top 
of existing business operations. All these aspects of transformation need to come together to 
realize the full potential of data and analytics. The challenges incumbents face in pulling this 
off are precisely why much of the value we highlighted in 2011 is still unclaimed. 

The urgency for incumbents is growing, since leaders are staking out large advantages, and 
hesitating increases the risk of being disrupted. Disruption is already happening, and it takes 
multiple forms. Introducing new types of data sets (“orthogonal data”) can confer a 
competitive advantage, for instance, while massive integration capabilities can breakthrough 
organizational silos, enabling new insights and models. Hyperscale digital platforms can 
match buyers and sellers in real time, transforming inefficient markets. Granular data can be 
used to personalize products and services—including, most intriguingly, healthcare. New 
analytical techniques can fuel discovery and innovation. Above all, businesses no longer have 
to go on gut instinct; they can use data and analytics to make faster decisions and more 
accurate forecasts supported by a mountain of evidence. 

The next generation of tools could unleash even bigger changes. New machine-learning and 
deep-learning capabilities have an enormous variety of applications that stretch into many 
sectors of the economy. Systems enabled by machine learning can provide customer service, 






manage logistics, analyze medical records, or even write news stories. 


These technologies could generate productivity gains and an improved quality of life, but they 
carry the risk of causing job losses and dislocations. Previous MGI research found that 45 
percent of work activities could be automated using current technologies; some 80 percent 
of that is attributable to existing machine-learning capabilities. Breakthroughs in natural- 
language processing could expand that impact. 

Data and analytics are already shaking up multiple industries, and the effects will only 
become more pronounced as adoption reaches critical mass—and as machines gain 
unprecedented capabilities to solve problems and understand language. Organizations that 
can harness these capabilities effectively will be able to create significant value and 
differentiate themselves, while others will find themselves increasingly at a disadvantage. 



The need to lead in data and analytics 


In a new survey, executives say senior-leader involvement and the right 
organizational structure are critical factors in how successful a company’s 
analytics efforts are, even more important than its technical capabilities or 
tools. 


E xecutives have high hopes for their data and analytics programs. Large majorities of 
respondents to a recent McKinsey Global Survey on the topic expect their analytics 
activities to have a positive impact on company revenues, margins, and organizational 
efficiency in the coming years. To date, though, respondents report mixed success in 
meeting their analytics objectives. For those lagging behind, a lack of strategy or tools isn’t 
necessarily to blame. Rather, the results suggest that the biggest hurdles to an effective 
analytics program are a lack of leadership support and communication, ill-fitting 
organizational structures, and troubles finding (and retaining) the right people for the job. 

Leadership and organization matter 

Respondents say their organizations pursue data and analytics activities for a range of 
reasons, most often to build competitive advantage or improve the customer experience. 
Whatever the motivation, companies have found mixed success: 86 percent of executives say 
their organizations have been at best only somewhat effective at meeting the primary 
objective of their data and analytics programs, including more than one-quarter who say 
they’ve been ineffective. 



However, a select group of executives report greater effectiveness and more developed 
analytics capabilities relative to their peers. Compared with their lower-performing peers, 
these high performers say their analytics activities have had a greater impact on company 
revenue in the past three years. And some of the biggest qualitative differences between 
high- and low-performing companies, according to respondents, relate to the leadership and 
organization of analytics activities. High-performer executives most often rank senior- 
management involvement as the factor that has contributed the most to their analytics 
success; the low-performer executives say their biggest challenge is designing the right 
organizational structure to support analytics (Exhibit 1). 



Exhibit 1 


Senior-leader involvement and organizational structure 
play a critical role in how effective (or not) a company’s 
analytics efforts are. 


Most significant reason 
for organizations’ 
effectiveness at data 
and analytics 1 


Most significant challenge 
to organizations’ 
effectiveness at data 
and analytics 1 


% of respondents at high- % of respondents at low- 
performing organizations, 2 performing organizations, 3 
n = 138 n = 64 


Ensuring senior- 
management involvement 
in data and analytics 
activities 



Designing effective data 
architecture and technology 
infrastructure to support 
analytics activities 

Securing internal leadership 
for analytics projects 

Providing business functions 
with access to support for | 11 

both data and analytics 

Tracking business impact 
of analytics activities 






Creating flexibility in existing 
processes to take advantage 
of new analytics insights 


Designing an appropriate 

organizational structure to 7 25 

support analytics activities 



Attracting and/or retaining 
appropriate talent (ie, both 6 

functional and technical) 

















Constructing a strategy 
to prioritize investment 
in analytics 




Investing at scale in 
analytics initiatives 

''Respondents who answered “other” or “don’t know” are not shown. 

Respondents who say their organizations have been effective at reaching the main objective of 
their data and analytics activities, and have more developed analytics capabilities than industry 
competitors. This question was asked only of respondents who said their organizations have 
met their analytics objectives effectively. 

Respondents who say their organizations have been ineffective at reaching the main objective of 
their data and analytics activities, and have less developed analytics capabilities than industry 
competitors. This question was asked only of respondents who said their organizations have not 
met their analytics objectives effectively. 



On the whole, responses suggest that company leaders are less involved in analytics efforts 
than they are in digital activities. In McKinsey’s latest survey on digitization, 38 percent of 
respondents said their CEOs were leading the digital agenda for their companies; in this 
survey, just one-quarter say their CEOs lead the data and analytics agenda. But even when 
analytics are top of mind for company leaders, many of them don’t seem to be communicating 
a clear vision throughout their organizations. Thirty-eight percent of CEOs say they lead their 
companies’ analytics agendas, but only 9 percent of all other C-suite executives agree 
(Exhibit 2). These respondents are much more likely to cite chief information officers or 
business-unit heads as leaders of the analytics agenda. 





Exhibit 2 


CEOs are much likelier than all other C-level respondents to 
cite themselves as leaders of the analytics agenda. 


% of respondents, 1 by role 


■ CEOs, n = 256 

All other C-level 
executives, n = 175 


Who is primarily responsible for data and analytics agenda at 
respondents’ organizations 



Chief 

information 

officer 



Chief data 
or analytics 
officer 



5 

5 


Chief 

marketing 

officer 



Board of 
directors 



5 


3 


Business- 
unit heads 



Chief digital 
officer 



9 


Respondents who answered “other” or “don’t know” are not shown. 


Sponsorship is another area where company leaders can do more, and where the high and 
low performers differ notably. Respondents at high performers in analytics are nearly three 
times likelier than their low-performer peers to say their CEOs directly sponsor their analytics 
initiatives (Exhibit 3). 






Exhibit 3 


High-performer respondents report a much higher 
rate of CEO sponsorship for analytics than their 
low-performing peers. 

% of respondents 1 Sponsorship of data and analytics initiatives at 

respondents’ organizations 

Respondents at high- Respondents at low- 

performing organizations, 2 performing organizations, 3 

n = 143 n = 67 


Most initiatives are 
sponsored by CEO 


Most initiatives are 
sponsored at CxO 
level (ie, by CEO’s 
direct reports) 

Most initiatives 

are sponsored at 23 46 

CxO-1 level 




No initiatives are 
sponsored at CxO or 1 
CxO-1 levels 

''Respondents who answered “don’t know/not applicable” are not shown. 

Respondents who say their organizations have been effective at reaching the main objective 
of their data and analytics activities, and have more developed analytics capabilities than 
industry competitors. 

Respondents who say their organizations have been ineffective at reaching the main 
objective of their data and analytics activities, and have less developed analytics capabilities 
than industry competitors. 



Just as companies pursue varied objectives with their analytics activities, they also differ in 
how they organize around this work. There is no consensus on a single structure—centralized, 
decentralized, or a hybrid model—that most companies use. But the executives who report 












using a hybrid structure—a central analytics organization that coordinates with employees 
who are embedded in individual business units—say analytics has a greater impact on both 
cost and revenue than other respondents do. Relative to others, these executives also report 
a broader range of analytics capabilities (including more sophisticated tools and advanced 
modeling techniques) and a greater number of business functions pursuing analytics 
activities. 

Talent troubles 

For many companies—especially the low performers—the results indicate that attracting and 
retaining talent are more difficult for data and analytics than for other parts of the business. In 
particular, executives say it’s challenging both to find and to retain business users with 
analytical skills, even more than data scientists and engineers (Exhibit 4). Within the C-suite, 
the CEOs’ direct reports are more likely than CEOs themselves to cite difficulty attracting 
executive leaders for analytics—roles that are critical, given the correlation between 
leadership involvement and overall analytics success. 



Exhibit 4 



Many companies find it difficult to attract and retain analytics 
talent—especially business users with analytics-related skills. 


% of respondents ■ Easier Same More difficult Don’t know 


Attract 


Retain 


Organizations’ ability to 
attract and retain data and 
analytics talent, relative to 
other kinds of talent, 1 

n = 519 


13 

27 

48 

11 

14 

30 

42 


Analytics talent that 
organizations struggle most 
to attract and retain 2 


Business users with analytics 
skill sets 


Data scientists or engineers 


Executive leaders for data 
and analytics organization 


Data architects 


Translators (ie, employees 
with both technical and 
domain expertise) 




''Figures do not sum to 100%, because of rounding. 

Respondents were asked this question only if they said it was more difficult or much more 
difficult to attract and/or retain data and analytics talent compared with talent for other parts 
of their organizations. For the “attract” question, n = 249; for the “retain” question, n = 223. 
Those who answered “other” and “don’t know/not applicable” are not shown. 




















The most significant talent challenges that companies face, according to respondents, are a 
lack of structured career paths (especially at larger companies) and the inability to compete 
effectively on salary and benefits. These two challenges are even more acute for companies 
where analytics work is decentralized (that is, when analytics employees are embedded in 
individual business units and act independently), reflecting the difficulty of creating a distinct 
analytics culture without a central team and leader. And while executives at low-performing 
companies report the same challenges as others, they overwhelmingly cite a lack of 
leadership support as the primary challenge to both attracting and retaining talent—once 
again underscoring the importance of leaders’ involvement in advancing the goals of data and 
analytics efforts. 

Compounding the talent challenge is that traditional recruiting methods seem to be falling 
short. Only 16 percent of respondents say their organizations have successfully found data 
and analytics talent through recruitment agencies and search firms. Other approaches, 
though, have worked better. Respondents most often cite retraining current employees as an 
effective method, which eliminates the need to find new hires and attract them away from 
other opportunities. At high-performing companies, respondents have also found success by 
developing a unique recruiting team for analytics employees. 

How companies are getting it right 

Beyond better talent practices and more active CEO involvement, executives at high- 
performing companies report other practices that differentiate their analytics activities. Most 
executives—including three-quarters of those at low-performing companies—say their 
organizations have established some analytics capabilities. However, the high performers 
report significantly more advanced capabilities across the board (Exhibit 5). They are, for 
example, nearly five times likelier than their low-performing peers to say they have tools and 
expertise to work with unstructured and real-time data. And they are nearly twice as likely to 
say they make data accessible across their organizations. 



Exhibit 5 



At high-performing organizations, respondents report 
much more advanced data and analytics capabilities than 
their peers. 


% of respondents 1 Data and analytics capabilities at 

respondents’ organizations 


Respondents 
at high-performing 
organizations, 2 

n = 143 


Respondents 
at low-performing 
organizations, 3 

n = 67 


Data that are accessible 
across organization 

Tools and expertise to work with 
unstructured, real-time data 

A self-serve analytics capability for 
business users (ie, to run 52 

customizable analytics queries) 

Big data and advanced analytics 
tools (eg, Hadoop, SAS/SPSS) 

Advanced modeling 
techniques (eg, machine learning, 
natural language processing, 
real-time analytics) 







Other 



I 


4 


None 



’'Respondents who answered “don’t know” are not shown. 

Respondents who say their organizations have been effective at reaching the main objective 
of their data and analytics activities, and have more developed analytics capabilities than 
industry competitors. 

Respondents who say their organizations have been ineffective at reaching the main objective 
of their data and analytics activities, and have less developed analytics capabilities than 
industry competitors. 















High performers are also more diligent than others when it comes to measuring results, and 
more likely than their peers to track most of the nine analytics-related metrics we asked 
about. Fifty-four percent of high performers, for example, say their companies track the 
impact of their analytics activities on top-line revenues. By contrast, only 19 percent of 
respondents at low performers say they measure the impact on revenue. 

Finally, high performers extend their data and analytics activities more broadly across the 
organization. Fifty-nine percent of these executives say their R&D functions use analytics, 
compared with just one-fifth of low-performing respondents. What’s more, the high 
performers are more likely than low performers to say their primary purpose with analytics is 
building competitive advantage—and less likely to say they are simply trying to cut costs. 

Looking ahead 

• Communicate from the top. The results indicate that even if CEOs are aware of their 
analytics activities—and their importance to the business—many are failing to 
communicate their vision and strategy across the organization. This lack of 
communication can confuse the groups responsible for implementing analytics and can 
hinder collaboration among functional teams. Senior-leader involvement also goes a 
long way toward creating a culture that values this work, a critical factor in an 
organization’s ability to recruit data and analytics talent and to capture value from their 
efforts. Company leaders must continually articulate the importance of analytics by 
hosting town-hall meetings, monitoring results on company dashboards, and 
incentivizing senior managers to focus on these initiatives. 

• Organize for success. While there is still debate over which operating model works best 
for analytics, the survey results suggest that companies using a hybrid approach often 
see greater impact from analytics than companies with either a strictly centralized or 
decentralized model. However they decide to organize, though, companies must 
ensure that they have the right balance of technical and domain expertise, that 
resources are being used efficiently, and that all analytics resources align closely with 
the goals and targets of the business units they support. 



Find new ways to attract talent. Most respondents say it’s difficult to attract and retain 
the best data and analytics talent through traditional recruiting means. To attract good 
people, companies will need to develop a distinct culture, career paths, and recruiting 
strategy for data and analytics talent; ensure that analytics employees have a close 
connection with company leaders; and articulate the unique contributions that data and 
analytics talent can make. They must also identify and tap into new or alternative 
sources of talent—retraining existing employees, for example, or forming innovative 
external partnerships. 




Compliance in 2016: More than just 
following rules 


The traditional approach is losing effectiveness. Banks must turn the page 
and build a new model. 


T he tougher compliance environment has not only multiplied the various regulations 
that financial institutions must follow but has also made it necessary for banks to think 
about compliance in an entirely different way. Those that throw out the old playbook and 
adapt to this new reality may enjoy a distinct competitive advantage. 

Since 2009, regulatory costs have increased dramatically relative to banks’ earnings and 
credit losses. More important, the scope of regulators’ focus continues to expand, with new 
issues emerging and getting more attention. They include conduct risk, the quality of banks’ 
corporate and risk culture, the next generation of anti-money-laundering measures, and 
third-party risk management. Banks, as they must, have continued to respond to these 
immediate pressures. 

But the industry also needs to implement more structural changes in its compliance 
processes to make its risk and internal-control frameworks more effective and sustainable 
overtime. 

The traditional model for bank compliance was designed in a different era for a different 
purpose. An institution’s compliance professionals would operate largely in an advisory 
capacity, having less to do with identifying and managing risks. Rather, they would lend their 



insight to higher-level executives, resulting in inconsistent influence on actual business 
practices. 

Under this model, the compliance team has a limited understanding of business operations 
and underlying risk exposures. As a result, many banks still operating this way struggle with 
fundamental control issues in the first line of defense, such as compliance literacy, 
accountability, performance incentives, and risk culture. Compliance activities tend to be 
isolated, lacking a clear link to the broader risk-management framework, governance, and 
processes. More often than not, the net result is a dramatic increase in compliance and 
control costs, with either limited or unproven impact on a bank’s lingering risks. 

To turn the page and enable a more sustainable compliance model, banks should consider 
these four principles. 

Own the risk-control framework 

In most cases, banks need to transform the role of the compliance department from serving in 
an advisory function to having direct influence on risk management and monitoring. In 
practice, that means becoming an active co-owner of risks and providing independent 
oversight of the control framework. Given this evolution, compliance specialists now must 
focus on these four responsibilities: having an independent and objective perspective on the 
quantum of residual compliance risk; translating laws, rules, and regulations into specific 
operational requirements; requesting and approving remediation activities; and shaping the 
bank’s overall risk culture and literacy. 

These expanded responsibilities require an unprecedented level of insight into business 
practices, necessitating new compliance practices such as incorporating process walk¬ 
throughs into risk assessments, monitoring significant operational changes, and developing 
residual-risk metrics and markers. 

Integrating a common compliance vision into an institution’s separate business units is also 
increasingly important. Institutions should stop thinking about different compliance risks as 
being embedded just within individual business units. That silo model should shift to one 
where business-unit coverage is combined with horizontal expertise around key compliance 


areas. 



Focus on what’s getting through the 
cracks 


A common compliance practice is to mandate business-led identification of high-risk 
processes, as well as all risks and all controls that pertain to them. But this approach falls 
short of achieving transparency into all material-risk exposures. It often becomes merely a 
mechanical exercise, resulting in lengthy, qualitative, and indiscriminate lists of risks and 
controls instead of identifying material-risk exposures and their root causes. Essentially, this 
model means a bank’s understanding of the residual risks, which might be getting through the 
cracks, is insufficient. 

The new compliance approach needs to focus instead on residual-risk exposures in order to 
ensure that no material risk is left unattended and then enable effective corresponding 
oversight and remediation. It should tie regulatory requirements directly to specific process 
break points by defining which risks apply to a given business process, identifying exactly 
where they could occur and why, and defining objective key risk indicators in the areas where 
a process creates material residual-risk exposure. 

Tie compliance to operational-risk 
concerns 

A modern compliance framework must be integrated with the bank’s operational-risk view of 
the world. 

Integrating the management of these risks offers tangible benefits. It ensures a 
comprehensive coverage of risks, lessens the burden on the business and the control 
functions, and facilitates a more efficient allocation of enterprise resources and management 
attention. 

Banks can start this journey by developing an integrated inventory of operational and 
compliance risks; standardizing risk, process, product, and control taxonomies; coordinating 
risk assessment, remediation, reporting methodologies, and calendars; and clarifying roles 
and responsibilities among control functions for each material-risk type to ensure there are 
no gaps or overlaps. 



Some banks are also making changes in the organizational structure and placement of the 
compliance function. A few global banks have moved compliance under the supervision of the 
risk department, which reinforces the view of compliance as a control function rather than an 
advisory function and facilitates an integrated view across all risk types. 


Monitor and measure progress from the 
top down 


The three previous principles help in executing a multifaceted compliance transformation. But 
banks can maximize the impact of a new compliance approach by rigorously monitoring how 
progress is meeting desired outcomes. A clear tone from the top and active board oversight in 
measuring the success of a more structural compliance system are important. An institution 
should monitor progress in raising the stature of compliance, creating an integrated view of all 
risks, achieving a strong risk culture, driving risk ownership, employing a risk-based program 
to assess compliance risks, using quantitative metrics and qualitative markers to measure 
compliance risk, and ensuring that the first line of defense is taking action and owning 
compliance and control issues. 




The future of bank risk management 


Banks have made dramatic changes to risk management in the past 
decade—and the pace of change shows no signs of slowing. Here are six 
initiatives to help them stay ahead. 


R isk management in banking has been transformed over the past decade, largely in 
response to regulations that emerged from the global financial crisis and the fines 
levied in its wake. But important trends are afoot that suggest risk management will 
experience even more sweeping change in the next decade. 

The change expected in the risk function’s operating model illustrates the magnitude of what 
lies ahead. Today, about 50 percent of the function’s staff are dedicated to risk-related 
operational processes such as credit administration, while 15 percent work in analytics. 
McKinsey research suggests that by 2025, these numbers will be closer to 25 and 40 
percent, respectively. 

No one can draw a blueprint of what a bank’s risk function will look like in 2025—or predict all 
forthcoming disruptions, be they technological advances, macroeconomic shocks, or banking 
scandals. But the fundamental trends do permit a broad sketch of what will be required of the 
risk function of the future. The trends furthermore suggest that banks can take some 
initiatives now to deliver short-term results while preparing for the coming changes. By acting 
now, banks will help risk functions avoid being overwhelmed by the new demands. 


Six trends 



Six trends are shaping the role of the risk function of the future. 


Trend 1: Regulation will continue to 
broaden and deepen 


While the magnitude and speed of regulatory change is unlikely to be uniform across 
countries, the future undoubtedly holds more regulation—both financial and nonfinancial— 
even for banks operating in emerging economies. 

Much of the impetus comes from public sentiment, which is ever less tolerant of bank failures 
and the use of public money to salvage them. Most parts of the prudential regulatory 
framework devised to prevent a repetition of the 2008 financial crisis are now in place in 
financial markets in developed economies. But the future of internal bank models for the 
calculation of regulatory capital, as well as the potential use of a standardized approach as a 
floor (Basel IV), is still being decided. The proposed changes could have substantial 
implications, especially for low-risk portfolios such as mortgages or high-quality corporate 
loans. 

Governments are exerting regulatory pressure in other forms, too. Increasingly, banks are 
being required to assist in crackdowns on illegal and unethical financial transactions by 
detecting signs of money laundering, sanctions busting, fraud, and the financing of terrorism, 
and to facilitate the collection of taxes. Governments are also demanding that their banks 
comply with national regulatory standards wherever they operate in the world. Banks 
operating abroad must already adhere to US regulations concerning bribery, fraud, and tax 
collection, for example. Regulations relating to employment practices, environmental 
standards, and financial inclusion could eventually be applied in the same way. 

Banks’ behavior toward their customers is also under scrutiny. The terms and conditions of 
contracts, marketing, branding, and sales practices are regulated in many jurisdictions, and 
rules to protect consumers are likely to tighten. Banks will probably be closely examined for 
information asymmetries, barriers to switching banks, inappropriate or incomprehensible 
advice, and nontransparent or unnecessarily complex product features and pricing structures. 
The bundling and cross-subsidizing of products could also become problematic. In certain 



cases, banks might even be obliged to inform their customers of more suitable products with 
better terms than the ones they have—such as a lower remortgage rate. (Utility suppliers in 
some markets are already obliged to do this.) 

This tightening regulatory environment makes unviable the traditional model to manage 
regulatory risks; the risk function will need to build even more robust regulatory and 
stakeholder-management capabilities. Risk functions must not only ensure compliance with 
existing rules but also review the entire sales-and-service approach through a broad, 
principle-based lens. In addition, the risk function will play a vital role in collaborating with 
other functions to reduce risk—for example, by working more closely with the business to 
integrate and automate the correct behaviors and to eliminate human interventions. The risk 
function’s tasks will be to ensure that compliance considerations are always top of mind and 
not addressed perfunctorily by businesses after they have formulated their strategies or 
designed a new product. 

Trend 2: Customer expectations are rising 
in line with changing technology 

Technological innovation has ushered in a new set of competitors: financial-technology 
companies, or fintechs. They do not want to be banks, but they do want to take over the direct 
customer relationship and tap into the most lucrative part of the value chain—origination and 
sales. In 2014, these activities accounted for almost 60 percent of banks’ profits. They also 
earned banks an attractive 22 percent return on equity, much higher than the gains they 
received from the provision of balance sheet and fulfillment, which generated a 6 percent 
return on equity. 

The seamless and simple apps and online services that fintechs offer are beginning to break 
banks’ heavy gravitational pull on customers. Most fintechs start by asking customers to 
transfer a single piece of their financial business, but many then steadily extend their services. 
If banks want to keep their customers, they will have to up their game, as customers will 
expect intuitive, seamless experiences, access to services at any time on any device, 
personalized propositions, and instant decisions. 



Banks’ responses to higher customer expectations will be automated: an instant response to 
retail and corporate credit decisions, for example, and a simple, rapid online account-opening 
process. For banks to deliver at this level, they will have to be redesigned from the 
perspective of customer experience and then digitized at scale. 

Fintechs such as Kabbage, a small-business lender that operates in the United Kingdom and 
the United States, set a high customer-service bar for banks—and present new challenges 
for their risk functions. Kabbage does not require loan applicants to fill out lengthy 
documents to establish creditworthiness. Instead, it draws upon a wide range of customer 
information from data sources such as PayPal transactions, Amazon and eBay trade 
information, and United Parcel Service shipment volumes. While it remains to be seen how 
such fintechs perform in the longer term, banks are learning from them. Some are designing 
account-opening processes, for example, where most of the requested data can be drawn 
from public sources. The risk function will have to work closely with each business to meet 
these kinds of customer expectations while containing risk to the bank. 

Technology also enables banks and their competitors to offer increasingly customized 
services. It may be possible eventually to create the “segment of one,” tailoring prices and 
products to each individual. This degree of customization is expensive for banks to achieve 
because of the complexity of supporting processes. Regulatory constraints might well be 
imposed in this area, however, to protect consumers from inappropriate pricing and approval 
decisions. 

To find ways to provide these highly customized solutions while managing the risk will be the 
task of the risk function, working jointly with operations and other functions. Risk 
management will need to become a seamless, instant component of every key customer 
journey. 

Trend 3: Technology and advanced 
analytics are evolving 

Technological innovations continuously emerge, enabling new risk-management techniques 
and helping the risk function make better risk decisions at lower cost. Big data, machine 
learning, and crowdsourcing illustrate the potential impact. 



• Big data. Faster, cheaper computing power enables risk functions to use reams of 
structured and unstructured customer information to help them make better credit risk 
decisions, monitor portfolios for early evidence of problems, detect financial crime, and 
predict operational losses. An important question for banks is whether they can obtain 
regulatory and customer approval for models that use social data and online activity. 

• Machine learning. This method improves the accuracy of risk models by identifying 
complex, nonlinear patterns in large data sets. Every bit of new information is used to 
increase the predictive power of the model. Some banks that have used models 
enhanced in this way have achieved promising early results. Since they cannot be 
traditionally validated, however, self-learning models may not be approved for 
regulatory capital purposes. Nevertheless, their accuracy is compelling, and financial 
institutions will probably employ machine learning for other purposes. 

• Crowdsourcing. The Internet enables the crowdsourcing of ideas, which many 
incumbent companies use to improve their effectiveness. Allstate Insurance Company 
hosted a challenge for data scientists to crowdsource an algorithm for new car- 
accident insurance claims. Within three months, they improved the predictive power of 
their model by 271 percent. 

Many of these technological innovations can reduce risk costs and fines, and they will confer 
a competitive advantage on banks that apply them early and boldly. However, they may also 
expose institutions to unexpected risks, posing more challenges for the risk function. Data 
privacy and protection are also important concerns that must be addressed with due rigor. 

Trend 4: New risks are emerging 

Inevitably, the risk function will have to detect and manage new and unfamiliar risks over the 
next decade. Model risk, cybersecurity risk, and contagion risk are examples that have 
emerged. 

• Model risk. Banks’ increasing dependence on business modeling requires that risk 
managers understand and manage model risk better. Although losses often go 
unreported, the consequences of errors in the model can be extreme. For instance, a 
large Asia-Pacific bank lost $4 billion when it applied interest-rate models that 



contained incorrect assumptions and data-entry errors. Risk mitigation will entail 
rigorous guidelines and processes for developing and validating models, as well as the 
constant monitoring and improvement of them. 

• Cybersecurity risk. Most banks have already made protection against cyberattacks a 
top strategic priority, but cybersecurity will only increase in importance and require ever 
greater resources. As banks store an increasing amount of data about their customers, 
the exposure to cyberattacks is likely to further grow. 

• Contagion risk. Banks are more vulnerable to financial contagion in a global market. 
Negative market developments can quickly spread to other parts of a bank, other 
markets, and other involved parties. Banks need to measure and track their exposure 
to contagion and its potential impact on performance. Measures to reduce a bank’s 
total risk can reduce its capital requirements, as contagion risk is one of the main 
drivers for classification as a global systemically important bank (G-SIB) and for G-SIB 
capital surcharges. 

To prepare for new risks, the risk-management function will need to build a perspective for 
senior management on risks that might emerge, the bank’s appetite for assuming them, and 
how to detect and mitigate them. And it will need the flexibility to adapt its operating models 
to fulfill any new risk activities. 

Trend 5: The risk function can help 
banks remove biases 

Behavioral economics has made great strides in understanding how people make decisions 
guided by conscious or unconscious biases. It has shown, for example, that people are 
typically overconfident—in a few well-known experiments, for example, enormous majorities 
of respondents rated their driving skills as “above average.” Anchoring is another bias, by 
which people tend to rely heavily on the first piece of information they analyze when forming 
opinions or making decisions. 

Business, too, is prone to bias. Business cases are almost always inflated, and if the first 
person to speak in a discussion argues in favor of an idea, the likelihood is high that most 
present, if not all, will agree. 



Biases are highly relevant for bank risk-management functions, as banks are in the business 
of taking risk, and every risk decision is subject to biases. A credit officer might write on a 
credit application, for example, “While the management team only recently joined the 
company, it is very experienced.” The statement may simply be true—or it may be an attempt 
to neutralize potentially negative evidence. 

Leading academics and practitioners have developed techniques for overcoming such biases, 
and various industries are beginning to apply them. Some energy utilities are trying to 
eliminate bias by redesigning the processes they follow in making major investment decisions, 
for example. Banks are also likely to deploy techniques to remove bias from decision making, 
including analytical measures that provide decision makers with more fact-based inputs, 
debate techniques that help remove biases from conversations and decisions, and 
organizational measures that embed new ways of decision making. 

The risk function could take the lead in de-biasing banks. It could even become a center of 
excellence that rolls out de-biasing processes and tools to other parts of the organization. 

Trend 6: The pressure for cost savings 
will continue 

The banking system has suffered from slow but constant margin decline in most geographies 
and product categories. The downward pressure on margins will likely continue, not least 
because of the emergence of low-cost business models used by digital attackers. As a result, 
the operating costs of banks will probably need to be substantially lower than they are today. 
After exhausting traditional cost-cutting approaches such as zero-based budgeting and 
outsourcing, banks will find that the most effective remaining measures left are simplification, 
standardization, and digitization. The risk function must play its part in reducing costs in these 
ways, which will also afford opportunities to reduce risks. A strong automated control 
framework, for example, can reduce human intervention, tying risks to specific process break 
points. As the pressure to reduce costs will persist, the risk function will need to find further 
cost-savings opportunities in digitization and automation while delivering much more for 
much less. 



Preparing for change 

The six trends suggest a vision for a high-performing risk function come 2025. It will need to 
be a core part of banks’ strategic planning, collaborate closely with businesses, and act as a 
center of excellence in analytics and de-biased decision making. Its ability to manage multiple 
risk types while complying with existing regulation and preparing for new rules will make it 
more valuable still, while its role in fulfilling customer expectations will probably render it a key 
contributor to the bottom line. For most banks, their risk function is some way off from being 
able to play that role. The optimal function would have the following attributes and 
capabilities: 

• full automation of decisions and processes with minimal manual interventions 

• increased reliance on advanced analytical models to de-bias decisions 

• close collaboration with businesses and other functions to provide a better customer 
experience, de-biased decisions, and enhanced regulatory preparedness 

• strong advocacy of corporate values and principles, supported by a robust risk culture 
that is clearly defined, communicated, and reinforced throughout the bank 

• a talent pool with superior advanced-analytics capabilities 

To put all this in place, risk functions will need to transform their operating models. How can 
they begin? They cannot prepare for every eventuality, but initiatives can be implemented that 
will bring short-term business gains while helping build the essential components of a high- 
performing risk function over the next decade. Here are some examples of such initiatives 
that can be launched immediately: 

• Digitize core processes. Simplification, standardization, and automation are key to 
reducing nonfinancial risk and operating expenses. To that end, the risk function can 
help speed the digitization of core risk processes, such as credit applications and 
underwriting, by approaching businesses with suggestions rather than waiting for the 
businesses to come to them. Increased efficiency, a superior customer experience, and 
improved sales will likely be additional benefits. 



Experiment with advanced analytics and machine learning. In the same vein, risk 
functions should experiment more with analytics, and particularly machine learning, to 
enhance the accuracy of their predictive models. Risk functions can be expected to use 
these models for a number of purposes, including financial-crime detection, credit 
underwriting, early-warning systems, and collections in the retail and small-and- 
medium-size-enterprise segments. 

Enhance risk reporting. Ever-broader regulation and the need to adjust to market 
developments require rapid, fact-based decision making, which means better risk 
reporting. While regulatory requirements have already done much to improve the 
quality of the data used in risk reports and their timeliness, less attention has been 
given to the format of reports or how they could be put to better use for making 
decisions. Replacing paper-based reports with interactive tablet solutions that offer 
information in real time and enable users to do root-cause analyses would enable 
banks to make better decisions faster and to identify potential risks more quickly as 
well. 

Collaborate for balance-sheet optimization. Given regulatory constraints, balance- 
sheet composition is arguably more important than ever in supporting profitability. The 
risk function can help optimize the asset and liability composition of the balance sheet 
by working with finance and strategy functions to consider various economic scenarios, 
regulation, and strategic choices. How prepared would the bank be, for example, if the 
loan portfolio were contracted or expanded? Such analyses, optimized with analytical 
tools, can help banks find ways to improve returns on equity by 50 to 400 basis points, 
while still fulfilling all regulatory requirements. 

Refresh the talent pool. High-performing risk functions commonly depend on a high- 
performing IT and data infrastructure—a central “data lake” with harmonized definitions 
and clear data governance, for example. Building the right mix of talent is equally 
important. Data scientists with advanced mathematical and statistical knowledge are 
needed to collaborate across the bank in the conversion of data insights into business 
actions. Risk managers will become trusted counselors to business areas, while 
traditional operational areas will require fewer staff. Attracting talented employees will 
itself be a challenge, as potential candidates would tend to prefer technology firms 
unless banks strengthen their value propositions. 



• Build a strong risk-management culture. The detection, assessment, and mitigation 
of risk must become part of the daily job of all bank employees and not only those in 
risk functions. With automation and more sophisticated analytical and technical 
capabilities, human intervention is needed to ensure appropriate and ethical 
application. 


The risk function will have a dramatically different role by 2025. To get there, needed changes 
will take several years, so time is already short. The actions recommended here can equip the 
risk function with the capabilities it needs to cope with new demands and help the bank to 
excel among its competitors. 




The value in digitally transforming 
credit risk management 


To withstand new regulatory pressures, investor expectations, and 
innovative competitors, banks need to reset their value focus and digitize 
their credit risk processes. 


E xternal and internal pressures are requiring banks to reevaluate the cost efficiency 
and sustainability of their risk-management models and processes. Some of the 
pressure comes, directly or indirectly, from regulators; some from investors and new 
competitors; and some from the banks’ own customers. 

The impact is being felt on the bottom line. In 2012, the share of risk and compliance in total 
banking costs was about 10 percent; in the coming year the cost is expected to rise to around 
15 percent. Overall, return on equity in banking globally remains below the cost of capital, due 
to additional capital requirements, fines, and lagging cost efficiency. All of this puts sustained 
pressure on risk management, as banks are finding it increasingly difficult to mitigate risk 
through incremental improvements in risk-management processes. 

To expand despite the new pressures, banks need to digitize their credit processes. Lending 
continues to be a key source of bank revenue across the retail, small and medium-size 
enterprise (SME), and corporate segments. Digital transformation in credit risk management 
brings greater transparency to risk profiles. With a firmer grip on risk, banks may expand their 
business, through more targeted risk-based pricing, faster client service without sacrifice in 
risk levels, and more effective management of existing portfolios. 



Incumbents under pressure 


Five fundamental pressures that relate directly to risk management are being exerted on 
banks’ current business model: customer expectations for digitally managed services; 
regulatory expectations of a high-performing risk function; the growing importance of strong 
data management and advanced analytics; new digital attackers disrupting traditional 
business models; and increasing pressure on costs and returns, especially from financial- 
technology (fintech) companies (Exhibit 1). 



Exhibit 1 


Five trends are altering the current risk-management model 
and making digitization a ‘must-have.’ 


Trends transforming the banking . . . . ., . . 

industry Impact on risk management (examples) 


1. Changing customer expectations Customer demand for online and mobile 

experience: mobile payments are expected to 
grow four times by 2020 

Internal users of risk reports (eg, chief risk 
officers) have heightened expectations for 
quality and timeliness 


2. Tighter regulatory control New regulations (eg, BCBS 239, 1 Basel 

requiring greater risk-function AML/KYC 2 ) 

effectiveness 

Tighter supervision and increased enforce¬ 
ment action (eg, more than $200 billion in 
fines since crisis; more than 4,000 MRAs 3 
still outstanding from OCC 4 ) 


3. Growing importance of strong 
data management and advanced 
analytics in staying competitive 



Robust customer-differentiation and risk- 
decision capabilities (eg, risk-based 
pricing, targeted segmentation through 
machine learning) 


Early-warning detection techniques to identify 
potential losses and exposures proactively 


4. New attackers driving business- Risk management is critical in enabling 

model disruptions banks to compete and/or collaborate 

with fintech companies on products and 
customer experience 

Risk can position banks favorably if fintech 
companies take inappropriate risks (“bets”) 


5. Increasing pressure, especially Return on equity for global banking remains 

from financial-technology below cost of capital despite lower risk losses 

companies, on costs and returns 

JP Morgan Chase spending well over 
$1 billion on risk and compliance; HSBC 
adding more than 3,000 resources 








'Basel Committee on Banking Supervision regulation number 239. 
2 Anti-money laundering/know your customer. 

3 Matters requiring attention. 

4 US Office of the Comptroller of the Currency. 


Customer expectations. Traditionally reliant on physical distribution, banks are finding it 
difficult to meet changing customer needs for speed and simplicity, such as fast online credit 
approvals. 

Regulatory and supervisory road map. Regulators are expecting the risk function to take a 
more active role in the context of new, digitized business models. New regulations are being 
put in place to address cyberrisk, automation of controls, and issues relating to risk-data 
aggregation. Directives pertaining to the Comprehensive Capital Analysis and Review, BCBS 
239, and asset-quality reviews specify requirements for data management and the accuracy 
and timeliness of the data used in stress testing. 

Data management and analytics. Rising customer use of digital-banking services and the 
increased data this generates create new opportunities and risks. First, banks can integrate 
new data sources and make them available for risk modeling. This can enhance the visibility of 
changing risk profiles—from individuals to segments to the bank as a whole. Second, as they 
collect customers’ personal and financial data, banks are mandated to address privacy 
concerns and especially protect against security breaches. 

Fintech companies and other innovative attackers. The digitally savvy segments have 
responded to innovative offerings from new nontraditional competitors, especially fintech 
companies and digital-only banks. These start-ups are extending innovation throughout the 
digital-banking space, creating a competitive threat to traditional banks but also potentially 
valuable opportunities for partnerships (Exhibit 2). 



Exhibit 2 


Financial-technology companies are extending innovation in 
the digital-banking space to all client segments. 


Share of fintechs in digital-banking space, % of start-ups and innovations in 
fintech database, by segment and product 1 


Customer 

segments 


Retail 


Commercial 2 


Large 

corporate 3 


Share of global banking revenue 
<5.0 5.0-7.5 ■ 7.5-10.0 ■ >10.0 



Account Lending Payments Financial 

management and assets and 

and deposits 4 financing capital 

markets 5 


Products and capabilities 


Implications for risk 

Faster innovation from 
thousands of fintech 
start-ups creates new 
opportunities in risk 
management 

Potential partnerships 
are available to acceler¬ 
ate the risk function’s 
transformation 

Internet technology is 
enabling crowdsourcing 
and risk disintermedia¬ 
tion—but also giving 
banks opportunities 
to increase connectivity 
with their clients’ digital 
ecosystems (eg, 
peer-to-peer lending 
integration) 


^cKinsey’s financial-technology database includes >350 of the best-known start-ups, but it may not 
be fully representative for any one segment or product, 
includes small and medium-size enterprises. 

includes large corporations, public entities, and nonbanking financial institutions. 

4 Revenue share includes current-account deposit revenue. 

includes investment banking, sales and trading, securities services, retail investment, noncurrent- 
account deposits, and asset-management factory. 






Pressure on cost and returns. The new competitors are beginning to threaten incumbents’ 
revenues and their cost models. Without the traditional burden of banking operations, branch 
networks, and legacy IT systems, fintech companies can operate at much lower cost-to- 
income ratios—below 40 percent. 

Fighting back 

Banks are beginning to respond to these trends, albeit slowly. Over the past several years, 
leading banks have begun to digitize core processes to increase efficiency—in particular, risk- 
related processes, where the largest share of banks’ costs are typically concentrated. Most 
banks started with retail credit processes, where the potential efficiency gains are most 
significant. Digital approaches can be more easily adopted from well-established online 
retailers: mobile applications, for example, can be developed to enable the origination of 
tailored personal loans possible instantaneously at the point of sale. More recently, banks 
have begun to capture efficiency gains in the SME and commercial-banking segments by 
digitizing key steps of credit processes, such as the automation of credit decision engines. 

The automation of credit processes and the digitization of the key steps in the credit value 
chain can yield cost savings of up to 50 percent. The benefits of digitizing credit risk go well 
beyond even these improvements. Digitization can also protect bank revenue, potentially 
reducing leakage by 5 to 10 percent. 

To give an example, by putting in place real-time credit decision making in the front line, 
banks reduce the risk of losing creditworthy clients to competitors as a result of slow approval 
processes. Additionally, banks can generate credit leads by integrating into their suite of 
products new digital offerings from third parties and fintech companies, such as unsecured 
lending platforms for business. Finally, credit risk costs can be further reduced through the 
integration of new data sources and the application of advanced-analytics techniques. These 
improvements generate richer insights for better risk decisions and ensure more effective 
and forward-looking credit risk monitoring. The use of machine-learning techniques, for 
example, can help banks improve the predictability of credit early-warning systems by up to 
25 percent (Exhibit 3). 



Exhibit 3 


Digital credit risk management uses automation, connectivity, 
and digital delivery and decision making to create value in 
three ways. 


Protect revenue 

5-10% of opportunity 


Meeting customer 
demand for digital 
services (real-time 
decisions, self-service 
credit applications) 

Minimizing risk of losing 
good customers to 
competitors as result of 
slow approval processes 

Integration with third 
parties for credit (fintech 
companies, peer-to-peer 
lending) 

Dynamic risk-adjusted 
pricing and limit setting 


Reduce cost of risk 
mitigation 

10-25% better predictions 


Advanced analytics and 
machine learning increase 
accuracy of risk models 
(admission, monitoring, 
workouts) and reduce 
number of judgment- 
related errors 

Integration of new data 
sources (internal, external, 
unstructured) to generate 
better insights and make 
better decisions 

Real-time data process¬ 
ing, as well as digital-risk 
reporting and monitoring 
for forward-looking risk 
management 


Reduce operational costs 

20% of opportunity overall 


Digitized process execu¬ 
tion to ensure that time 
and resources are spent 
in value-adding activities 

Standardized inputs and 
outputs and paperless 
credit risk processes 

Automated credit work 
flow to minimize manual 
data loading and errors 


Good progress has been made, but it is only a beginning. Many risk-related processes remain 
beyond the digital capabilities of most banks. Significant effort has been expended on the 
digital credit risk interface, but the translation of existing credit processes into the online 
world falls far short of customer expectations for simple digital management of their finances. 




There is plenty of room for digital improvement in client-facing processes, but banks also 
need to go deeper into the credit risk value chain to find opportunities to create value through 
digitization. The systematic mapping and analysis of the entire credit risk work flow is the best 
way to begin capturing such opportunities. The key steps—from setting risk appetite and 
limits to collection and restructuring—can be mapped in detail to reveal digitization 
opportunities. The potential for revenue improvement, cost reduction, and credit risk 
mitigation for each step should be weighed against implementation cost to identify high-value 
areas for digitization (Exhibit 4). 

Exhibit 4 


To find the areas where digitization will create the most 
value, map the entire credit risk work flow. 


I >10% of current 
baseline 


5-10% of current 
baseline 


<5% of current 
baseline 


O Potential priority area 


Credit risk value chain 


5 

o 


o 

5 


Appetite and limit 
setting 

Organization 
(customer contract) 


Credit analysis 
and decision 


Back office and loan 
administration 

Monitoring and early- 
warning system 

Collection and 
restructuring 

Reporting 


High-level digital credit risk value map 

Potential for Potential to 

revenue Potential for reduce cost of 
improvement cost reduction risk mitigation 


Strategies and policies 
Sales and planning 
Pricing 
Analysis 

Scoring and rating 

Application 

Decision 

Contracts and documents 
Collateral management 
Issue identification 
Action recommendation 
Workout strategies 
Restructuring 
Report generation 

h- 

Insights and analysis 
Work-flow support 

















Some improvement opportunities will cut across client segments, while others will be 
segment specific. In origination, for example, most banks will probably find that several 
segments benefit from a digitally connected, paperless credit underwriting process (with live 
access to customer data). At the stage of credit monitoring and early warning, furthermore, 
advanced analytics and fully leveraged internal and external data could improve risk models 
for identifying issues across different segments. Back-office and loan-administration tools 
such as straight-through processing and automated collateral valuation are also cross¬ 
cutting improvements, as are the automation and interactivity of risk reporting. 

On the other hand, in credit analysis and decision making, banks will likely find that instant 
credit decisions are mostly relevant in the retail and SME segments, while the corporate and 
institutional segments would benefit more from smarter work-flow solutions. The application 
of geospatial data, combined with advanced analytics, for example, can yield a high- 
performing asset-valuation model for mortgages in the retail segment. For collection and 
restructuring, automated propensity models will match customers in the retail and SME 
segments with specific actions, while for the corporate segment banks will likely need to 
develop debt restructuring-simulation tools, with a digital interface to identify and assess 
optimal strategies in a more efficient and structured way. 

How digital credit creates value 

Several leading banks have implemented digital credit initiatives that already created 
significant value. These are a few compelling cases: 

1. Sales and planning. One financial institution’s journey to an interactive front line 
involved the construction of a digital workbench for relationship managers (RMs). The 
challenges to optimal frontline performance were numerous and included the lack of 
systematic skill building, customer-relationship-management (CRM) systems with a 
fragmented overview of clients, and difficulty gathering relevant client and industry 
data. Onboarding, credit, and after-sales processes required many hours of paperwork, 
drawing frontline attention away from new client meetings. By engaging RMs with the 
IT solutions providers, the bank’s transformation team created a complete set of 



frontline tools for a single digital platform, including best-practice CRM approaches 
and product-specialist availability. The front line soon increased client interactions four 
to six times while cutting administrative and preparation time in half. 

2. The mortgage process. This presents a large opportunity for capturing digital value. 

One European bank achieved significant revenue uplift, cost reduction, and risk 
mitigation by fully automating mortgage-loan decisions. Much higher data quality was 
obtained through exchange-to-exchange systems and work-flow tools. Manual errors 
were eliminated as systems were automated and integrated, and top management 
obtained transparency through real-time data processing, monitoring, and reporting. 
Decisions were improved and errors of judgment reduced through rule-based decision 
making, automated valuation of collateral, and machine-learning algorithms. The bank’s 
automated real-estate valuation model uses publicly known sale prices to derive the 
amount of real-estate collateral available as a credit risk mitigant. The model, verified 
and continuously updated with new data, attained the same level of accuracy as a 
professional appraiser. Recognized by the regulator, it is saving the bank considerable 
time and expense in making credit decisions on actions ranging from underwriting to 
capital calculation and allocation. Losses were further minimized by automated 
monitoring of customers and optimized restructuring solutions. The digital engine 
moved decision making from 5 percent automated to 70 percent, reducing decision 
time from days to seconds. 

3. Insights and analysis. By making machine learning a part of the effort to digitize credit 
risk processes, banks can capture nearer-term gains while building a key capability for 
the overall transformation. Machine learning can be applied in early-warning systems 
(EWS), for example. Here it can enable deeper insights to emerge from large, complex 
data sets, without the fixed limits of standardized statistical analysis. At one financial 
institution, a machine learning-enhanced EWS enabled automated reporting, portfolio 
monitoring, and recommendations for potential actions, including an optimal approach 
for each case in workout and recovery. Debtor finances and recovery approaches are 
evaluated, while qualitative factors are automatically assessed, based on the 
incorporation of large volumes of nontraditional (but legally obtained) data. Expert 
judgment is embedded using advanced-analytics algorithms. In the SME segment, this 
institution achieved an improvement of 70 to 90 percent in its model’s ability accurately 
to predict late payments six or more months prior to delinquency. 



The approach: Working on two levels 


While the potential value in the digital enablement of credit risk management can be 
significant for early movers, a complete transformation may be required to achieve the bank’s 
target ambitions. This would involve building new capabilities across the organization and 
close collaboration among the risk function, operations, and the businesses. Given the 
complexity of the effort, banks should embark on this journey by prioritizing the areas where 
digitization can unlock the most value in a reasonable amount of time: significant impact from 
applying digital levers can be tangible in weeks. 

Rather than designing a master plan in advance, banks can in this context develop a digital 
approach to one area of credit risk management based on existing technology and business 
value. Each bank may develop initiatives based on their specific priorities. Banks that most 
need to increase regulatory compliance and the quality of their execution may begin with 
initiatives in process reengineering to reduce the number of manual processes or to build a 
fully digital credit risk engine. Those looking to improve customer value from greater speed 
and efficiency might implement such initiatives as a state-of-the-art digital credit¬ 
underwriting interface, a digitally enabled sales force, data-driven pricing, or straight-through 
credit decision processing. Banks needing to mitigate risk through better decision making 
may develop initiatives to automate and integrate early-warning and recovery tools and 
create an automated, flexible risk-reporting mechanism (a “digital-risk cockpit”). 

A credit risk transformation thus requires banks to work on two levels. First, look for initiatives 
that are within easy technological reach and that will also advance the core business 
priorities. Launching initiatives that bring in savings quickly will help the transformation effort 
become self-funding over time. Once a first wave of savings is captured, investments can be 
made in building the digital capabilities and developing the foundation for the overall 
transformation. Based on what has been learned in early-wave initiatives, moreover, new 
initiatives can be designed and rolled out in further waves. Typical first-wave initiatives digitize 
underwriting processes, including frontline decision making and reporting. Risk reporting is 
another likely candidate for early digitization, since digitization reduces production time and 
leads to faster decision making. 



Building digital capabilities: Talent, IT, 
data, and culture 


The experience of specific initiatives will help shape digital capabilities for the long term. 
These will be needed to support the overall digital transformation of credit risk management 
and keep the analytics and technology current. To begin, banks can examine their current 
capabilities and assess gaps based on the needs of the transformation. The talent focus in 
risk and across the organization will likely shift as a result toward a greater emphasis on IT 
expertise and quantitative analytics. 

In addition to enhancing their talent profiles, banks will have to shift the direction of their IT 
architecture. The target will likely be two-speed IT, a model in which the bank’s IT architecture 
is divided into two segments. Accordingly, the bank’s core (often legacy) IT systems constitute 
a slower and reliable back end, while a flexible and agile front end faces customers. Without a 
two-speed capability, the agility needed for digital credit risk management would not be 
attainable. 

Along with the supporting IT architecture and analytics talent, improved data infrastructure is 
an essential digital capability for the credit risk-management transformation. The uses of data 
are disparate throughout the bank and will continually change. For big data-analytics 
projects, great quantities of data are needed, but how they should be structured is not usually 
apparent at the outset. The construction of separate data sets for each use, furthermore, 
creates as many data silos within the organization as there are projects. 

For these reasons, some leading companies are moving toward utilizing a “data lake”—an 
enterprise-wide platform that stores all data in the original unstructured form. This approach 
can improve organizational agility, but it requires that each project has the capability to 
structure the data and understand data biases. All types of data infrastructure also pose 
security risks, moreover, which can be addressed only by IT experts. Finally, the 
reconfiguration of the data infrastructure needs to be done using methods that carefully 
respect legal privacy barriers and meet all regulatory requirements. 

Last, building and maintaining a strong digital-risk culture will be of critical importance in 
ensuring the success of the risk function of the future. A shift in culture and mind-set is 
needed among employees, top executives, and regulators, as they acclimate themselves to 



the new digital credit environment. Here, machines and automation have a much greater role, 
while human capabilities are developed to support the continual improvement of the risk 
culture. The focus shifts from executing a risk process to managing true control systems that 
continuously detect, assess, and mitigate risks. 

Toward a flexible digital-risk end state 

From data input and management to decision making, from customer contact to execution, 
the initiatives should build step by step toward a seamless and interactive digital-risk 
function. The initiative-first approach builds in the capability of agile adaptation to changes in 
customer demand or the competitive and regulatory environments. The digital opportunities 
and the way banks address them, in other words, will continually evolve, and the digital end 
state must support such changes while maintaining enhanced risk-management and client- 
service capabilities. 


The digital transformation of existing credit risk tools, processes, and systems can address 
rising costs, regulatory complexity, and new customer preferences. The digital enablement of 
credit risk management means the automation of processes, a better customer experience, 
sounder decision making, and rapid delivery. Digital-risk management will be the norm in the 
industry in five years, and banks that act now can attain enduring competitive advantage. 



Mobilizing your C-suite for big-data 
analytics 


Leadership-capacity constraints are undermining many companies’ 
efforts. New management structures, roles, and divisions of labor can all 
be part of the solution. 


O ver the past 30 years, most companies have added new C-level roles in response to 
changing business environments. The chief financial officer (CFO) role, which didn’t 
exist at a majority of companies in the mid-1980s, rose to prominence as pressures for value 
management and more transparent investor relations gained traction. Adding a chief 
marketing officer (CMO) became crucial as new channels and media raised the complexity of 
brand building and customer engagement. Chief strategy officers (CSOs) joined top teams to 
help companies address increasingly complex and fast-changing global markets. 

Today, the power of data and analytics is profoundly altering the business landscape, and 
once again companies may need more top-management muscle. Capturing data-related 
opportunities to improve revenues, boost productivity, and, sometimes, create entirely new 
businesses puts new demands on companies—requiring not only new talent and investments 
in information infrastructure but also significant changes in mind-sets and frontline training. 

It’s becoming apparent that without extra executive horsepower, stoking the momentum of 
data analytics will be difficult for many organizations. 



Because the new horizons available to companies typically span a wide range of functions, 
including marketing, risk, and operations, the C-suite can evolve in a variety of ways. In some 
cases, the solution will be to enhance the mandate of the chief information, marketing, 
strategy, or risk officer. Other companies may need new roles, such as a chief data officer, 
chief technical officer, or chief analytics officer, to head up centers of analytics excellence. 
This article seeks to clarify the most important tasks for executives playing those roles and 
then sets out some critical questions whose answers will inform any reconfiguration of the C- 
suite. Daunting as it may seem to rethink top-management roles and responsibilities, failing to 
do so, given the cross-cutting nature of many data-related opportunities, could well mean 
jeopardizing top- or bottom-line growth and opening the door to new competitors. 

Six top-team tasks behind data analytics 

Crafting and implementing a big-data and advanced-analytics strategy demands much more 
than serving up data to an external provider to mine for hidden trends. Rather, it’s about 
effecting widespread change in the way a company does its day-to-day business. The often- 
transformative nature of that change places serious demands on the top team. There’s no 
substitute for experienced hands who can apply institutional knowledge, navigate 
organizational hazards, make tough trade-offs, provide authority when decision rights 
conflict, and signal that the leadership is committed to a new analytics culture. In our 
experience, the concerted action that’s required falls into six categories. Leaders should take 
full measure of them before assigning responsibilities or creating roles. 

Establishing new mind-sets 

Senior teams embarking on this journey need both to acquire a knowledge of data analytics 
so they can understand what’s rapidly becoming feasible and to embrace the idea that data 
should be core to their business. Only when that top-level perspective is in place can durable 
behavioral changes radiate through the organization. An important question to ask at the 
outset is “Where could data analytics deliver quantum leaps in performance?” This exercise 
should take place within each significant business unit and functional organization and be led 
by a senior executive with the influence and authority to inspire action. 



Leaders at one large transportation company asked its chief strategy officer to take charge of 
data analytics. To stretch the thinking and boost the knowledge of top managers, the CSO 
arranged visits to big data-savvy companies. Then he asked each business unit to build data- 
analytics priorities into its strategic plan for the coming year. That process created a high- 
profile milestone related to setting real business goals and captured the attention of the 
business units’ executives. Before long, they were openly sharing and exploring ideas and 
probing for new analytics opportunities—all of which helped energize their organizations. 

Defining a data-analytics strategy 

Like any new business opportunity, data analytics will underdeliver on its potential without a 
clear strategy and well-articulated initiatives and benchmarks for success. Many companies 
falter in this area, either because no one on the top team is explicitly charged with drafting a 
plan or because there isn’t enough discussion or time devoted to getting alignment on 
priorities. At one telecommunications company, the CEO was keen to move ahead with data 
analytics, particularly to improve insights into customer retention and pricing. Although the 
company moved with alacrity to hire a senior analytics leader, the effort stalled just as quickly. 
To be sure, the analytics team did its part, diving into modeling and analysis. However, 
business-unit colleagues were slow to train their midlevel managers in how to use the new 
models: they didn’t see the potential, which, frankly, wasn’t part of “their” strategic priorities. 

As we have argued previously, capturing the potential of data analytics requires a clear plan 
that establishes priorities and well-defined pathways to business results, much as the familiar 
strategic-planning process does. Developing that plan requires leadership. At a North 
American consumer company, the CEO asked the head of online and digital operations, an 
executive with deep data knowledge, to create the company’s plan. The CEO further insisted 
that it be created in partnership with a business-unit leader who was not familiar with big 
data. This partnership—combining a data and analytics expert and an experienced frontline 
change operator— ensured that the analytics goals outlined in the plan were focused on 
actual, high-impact business decisions. Moreover, after these executives shared their 
progress with top-team counterparts, their collaborative model became a blueprint for the 
planning efforts of other business units. 



Determining what to build, purchase, 
borrow, or rent 


Another cluster of decisions that call for the authority and experience of a senior leader 
involves the assembly of data and the construction of advanced-analytics models and tools 
designed to improve performance. The resource demands often are considerable. With 
multitudes of external vendors now able to provide core data, models, and tools, top- 
management experience is needed to work through “build versus buy” trade-offs. Do 
strategic imperatives and expected performance improvements justify the in-house 
development and ownership of fully customized intellectual property in analytics? Or is 
reaching scale quickly so important that the experience and talent of vendors should be 
brought to bear? The creation of powerful data assets also can require the participation of 
senior leadership. Locking in access to valuable external data, for instance, may depend on 
forging high-level partnerships with customers, suppliers, or other players along the value 
chain. 

The radically diverging paths different retailers have chosen underscore the range of options 
leaders must weigh. Several retailers and analytics firms have established long-term 
contracts covering a broad sweep of analytics needs. Other large players, both brick-and- 
mortar and online, have invested in deep internal data and analytics expertise. Each of these 
choices reflects a dynamic set of strategic, financial, and organizational requirements that 
shouldn’t be left to middle management. 

Securing analytics expertise 

Under almost any strategic scenario, organizations will need more analytics experts who can 
thrive amid rapid change. The data-analytics game today is played on an open and 
(frequently) cloud-based infrastructure that makes it possible to combine new external and 
internal data readily and in user-friendly fashion. The new environment also requires 
management skills to engage growing numbers of deep statistical experts who create the 
predictive or optimization models that will underwrite growth. 



The hunt for such talent is taking place in what has become the world’s hottest market for 
advanced skills. Retaining these valued employees and then getting them to connect with 
business leaders to make a real difference is a true top-management task—one that often 
demands creative solutions. The leader of a big-data campaign at a major consumer 
company, for instance, decided to invest in an analytics unit distant from company 
headquarters. This other locale had abundant talent and a cultural environment preferred by 
data scientists and engineers. The leader then closed the loop, ensuring that each unit of the 
analytics team had a direct connection to a business-unit team at the company. 

Mobilizing resources 

Companies often are surprised by the arduous management effort involved in mobilizing 
human and capital resources across many functions and businesses to create new decision- 
support tools and help frontline managers exploit advanced analytics models. An empowered 
senior player is vital to breaking down the institutional barriers that frequently hamper efforts 
to supercharge decisions through data analytics. Success requires getting a diverse group of 
managers to coalesce around change—encouraging alignment across a wide phalanx of IT, 
business-lines, analytics, and training experts. The possibility of failure is high when 
companies don’t commit leadership. 

Take the example of a second transportation company, where middle managers across 
product areas were tasked with identifying data-analytics opportunities and then pushing 
them forward. The analytics managers were routinely frustrated when data teams failed to 
deliver data on schedule or in usable formats. When it came time to embed the resulting 
analytics into customized tools, managers faced additional frustrations as urgent requests 
worked their way through routine budgeting and planning processes. The company gave the 
task of stepping up the pace of its analytics agenda to a top marketing and sales executive, 
who assembled cross-functional teams including database managers, analysts, and software 
programmers. The teams rotated across analytics opportunities, steering them from launch to 
implementation in six- to eight-week bursts. Through this rapid mobilization, the company 
checked off several analytics priorities only months after the marketing leader took charge. 


Building frontline capabilities 



The sophisticated analytics solutions that statisticians and scientists devise must be 
embedded in frontline tools so simple and engaging that managers and frontline employees 
will be eager to use them daily. The scale and scope of this adoption effort—which must also 
involve formal training, on-the-job coaching, and metrics that clearly define progress— 
shouldn’t be downplayed. In our experience, many companies spend 90 percent of their 
investment on building models and only 10 percent on frontline usage, when, in fact, closer to 
half of the analytics investment should go to the front lines. 

Here, again, we have seen plenty of cases where no one on the top team assumed 
responsibility for sustained ground-level change. Lacking senior accountability and 
engagement, one financial-services company weathered several waves of analytics 
investment and interest only to have efforts fizzle when training and adoption fell short. 
Dismayed, business-unit leaders then took charge, investing in ongoing training sessions for 
managers and end users, pushing for the constant refinement of analytics tools, and tracking 
tool usage with new metrics. Over time, thanks to the consistent application of analytics, the 
transformation effort gained the hoped-for momentum. 

Putting leadership capacity where it’s 
needed 


As companies size up these challenges, most will concede that they need to add executive 
capacity. But that leaves unanswered important decisions about where, exactly, new roles will 
be located and how new lines of authority will be drawn. As we’ll outline below, our experience 
shows that companies can make a strong case for leading their data-analytics strategies and 
talent centrally or even for establishing a formal data-analytics center of excellence. However, 
frontline activities (mobilizing resources, building capabilities) will need to take place at the 
business-unit or functional level, for two reasons. First, the priorities for using data analytics 
to increase revenues and productivity will differ by business. Second, and just as important, 
companies best catalyze frontline change when they connect it with core operations and 
management priorities and reinforce it with clear metrics and targets. 

Beyond this bias for pushing frontline mobilization responsibility to business units, there is no 
single prescription for where and how a company should add leadership capacity. Given the 
relative immaturity of data-analytics applications, that shouldn’t be surprising. Yet as leaders 



review their options, they needn’t fly blind. Pushing for answers to three key questions, in our 
experience, brings strategic clarity to the needed organizational changes: 


1. Will a central customer or operational database be used across business units? 

2. Is there a compelling need to build substantial analytics resources internally to retain 
talent and build proprietary assets and advantages? 

3. Within each business unit, can the current functional executives handle the change- 
management challenge or should the company dedicate new executive capacity 
specifically for the data-analytics change effort? 

We’ll illustrate the importance of these issues through examples of companies that have 
addressed them in different ways. 


When central data assets are key 

At many consumer-services businesses, exploiting analytics involves combining transaction 
data across a number of businesses or channels. That approach allows these companies to 
shape insights such as how consumers engage with Web sites or decide between shopping 
online or in stores. These companies often have (or are building) new central data warehouses 
or data environments, as well as related data-management capabilities. In addition, they often 
are working through new rules of the road on issues such as how they can access data while 
protecting consumer privacy or ensure that key customers aren’t hassled by unnecessary 
contacts. 

In such cases, an enhanced role for the CIO—spearheading the development of the data- 
analytics strategy and talent building—is a popular path. Operationally, the CIO takes charge 
of efforts to develop the data and analytics infrastructure while letting the business units 
mobilize change aimed at exploiting it. 

At one multibusiness consumer-services company, for instance, the board and senior- 
leadership team recognized that a significant step-up in performance could be achieved if it 
fully exploited analytics opportunities across business lines by harnessing its multichannel 



databases. Recognizing the overarching role that the central databases play in the company’s 
agenda, the leadership designated the chief information officer to direct the effort and to 
define the data and analytics strategy. 

The leaders realized that each business unit, by necessity, would have its own targeted 
analytic priorities, such as strengthening promotional offers or optimizing inventory levels. 
Moreover, a different group of managers would be applying the insights across business 
units. The leadership concluded that under these circumstances, managing analysis and 
frontline training from the center would be a mistake and decided instead that the CIO should 
partner with business-unit leaders, sharing with them a tiered set of responsibilities. 

At present, the CIO is immersed in two key projects. The first is creating a new infrastructure 
that unites the company’s multichannel transaction data with external social-media and 
competitive information and delivers the result to business units through an intuitive interface. 
The second involves building up analytics expertise that can be assigned to different business 
units but managed centrally, at least for the next couple of years as the effort gains critical 
mass. The analytics team is led by a deeply experienced executive who reports to the CIO and 
provides a crucial injection of top-management capacity. In parallel, business-unit leaders are 
hammering out analytics priorities and building the skills of frontline managers who will use 
new models to, for example, redirect spending across media channels. 

When substantial internal analytics 
expertise is core to performance 

We are also seeing a second approach, which shares some of the centralized aspects we 
touched on above but specifically involves companies that decide to build rather than 
outsource a critical body of advanced analytics expertise. That decision often leads 
organizations to locate the expertise centrally, where it serves as a common platform for 
creating value across business units. 

At one consumer-facing company, analytics expertise and leadership were concentrated in 
the finance and risk-management team, which historically had accounted for significant data- 
related value creation. When the company began pursuing a more aggressive analytics 



strategy, the CFO took responsibility for several tasks, including defining the basic strategy, 
overseeing make-versus-buy decisions for the core risk-management analytics tools, 
mobilizing resources within the function’s analytics team, and building expertise. 

However, having made these primary decisions about analytics, the CEO and CFO soon 
realized that significant complementary efforts were needed to secure better data for the 
analytics team and to reinforce change efforts and revamp several processes across the 
business units. To lead these initiatives, they established a new position—chief data officer— 
within the CFO’s organization. This CDO proactively manages information, working with 
business managers to identify both internal and external data they may not even realize exists. 
Delivered ready for analysis, the data can be applied rapidly to needed tasks by modeling 
experts and, just as important, continually refreshed for new experiments and broader 
application. Many companies may find they need this type of leadership to support business 
leaders as they identify sources of data-driven advantages, work through analytics priorities, 
and try to accelerate frontline adoption. 

When managing scale and complexity 
within business units is paramount 

Whether elements of the effort are managed centrally or not, much of the data-analytics 
heavy lifting will fall on business or functional leaders within individual business units. A core 
question at the business-unit level is whether to add a new role or ask a key functional leader 
(such as the CMO or the head of operations) to add new responsibilities to what in all 
likelihood is already a pretty full plate. 

When the senior leaders of a large financial-services company took a wide-ranging look at its 
strategy, they decided that one business unit could gain a significant competitive edge if it 
doubled down on data analytics. To push the strategy ahead decisively, the company 
recruited a chief analytics officer, who reports to the business-line president and oversees a 
new center of excellence drawing on internal consultants, analytics modelers, and software 
programmers. 



This approach, which represents a significant organizational change, is accelerating the 
business unit’s data-transformation effort. As a top-team member, the CAO can drive a broad 
range of decisions, from setting analytics strategy to defining the responsibilities of frontline 
managers. Since the center of excellence spans multiple disciplines, the CAO can mobilize 
analytics and software-programming resources swiftly, which has sped up the creation of 
frontline tools. Meantime, operating from within the business unit has given him a deeper 
understanding of what makes it tick—its priorities, patterns of working, and ongoing 
challenges. This has paid off in sharper decisions about which tools to develop and a keener 
sense of the skills that training programs need to foster. The fact that the business unit’s 
leaders are engaged with the CAO on a day-to-day basis helps keep them focused on their 
analytics and adoption agendas. 

Building on this success, the company has recently taken the further step of adding another 
new role, a chief data officer, who reports to the CIO but works daily with the chief analytics 
officer to help knit together data and new analytics tools and to speed frontline change. 


For companies pursuing the potential of data analytics, a decision about leadership capacity 
looms—regardless of where in the end they decide to place it. For some, such as the 
consumer-facing companies described earlier, current top-team members will be asked to 
step up and assume broader leadership responsibilities, often with additional support from 
new, senior lieutenants. For others, such as the financial-services company we explored, 
establishing one or more new senior posts to drive the analytics agenda will be the best 
solution. 

At all companies, top teams, and probably board members as well, need a better 
understanding of the scale of what’s needed to ensure data-analytics success. Then they 
must notch these responsibilities against their existing management capacity in a way that’s 
sensitive to the organization’s core sources of value and that meshes with existing structures. 
None of this is easy, but it’s the only serious way to pursue data analytics as a new frontier for 
growth. 




How companies are using big data 
and analytics 


Just how do major organizations use data and analytics to inform strategic 
and operational decisions? Senior leaders provide insight into the 
challenges and opportunities. 


F ew dispute that organizations have more data than ever at their disposal. But actually 
deriving meaningful insights from that data—and converting knowledge into action—is 
easier said than done. We spoke with six senior leaders from major organizations and asked 
them about the challenges and opportunities involved in adopting advanced analytics: Murli 
Buluswar, chief science officer at AIG; Vince Campisi, chief information officer at GE 
Software; Ash Gupta, chief risk officer at American Express; Zoher Karu, vice president of 
global customer optimization and data at eBay; Victor Nilson, senior vice president of big data 
at AT&T; and Ruben Sigala, chief analytics officer at Caesars Entertainment. An edited 
transcript of their comments follows. 


Interview transcript 

Challenges organizations face in adopting 
analytics 



Murli Buluswar, chief science officer, AIG: The biggest challenge of making the evolution 
from a knowing culture to a learning culture—from a culture that largely depends on 
heuristics in decision making to a culture that is much more objective and data driven and 
embraces the power of data and technology—is really not the cost. Initially, it largely ends up 
being imagination and inertia. 

What I have learned in my last few years is that the power of fear is quite tremendous in 
evolving oneself to think and act differently today, and to ask questions today that we weren’t 
asking about our roles before. And it’s that mind-set change—from an expert-based mind-set 
to one that is much more dynamic and much more learning oriented, as opposed to a fixed 
mind-set—that I think is fundamental to the sustainable health of any company, large, small, 
or medium. 

Ruben Sigala, chief analytics officer, Caesars Entertainment: What we found 
challenging, and what I find in my discussions with a lot of my counterparts that is still a 
challenge, is finding the set of tools that enable organizations to efficiently generate value 
through the process. I hear about individual wins in certain applications, but having a more 
sort of cohesive ecosystem in which this is fully integrated is something that I think we are all 
struggling with, in part because it’s still very early days. Although we’ve been talking about it 
seemingly quite a bit over the past few years, the technology is still changing; the sources are 
still evolving. 

Zoher Karu, vice president, global customer optimization and data, eBay: One of the 

biggest challenges is around data privacy and what is shared versus what is not shared. And 
my perspective on that is consumers are willing to share if there’s value returned. One-way 
sharing is not going to fly anymore. So how do we protect and how do we harness that 
information and become a partner with our consumers rather than kind of just a vendor for 
them? 

Capturing impact from analytics 

Ruben Sigala: You have to start with the charter of the organization. You have to be very 
specific about the aim of the function within the organization and how it’s intended to interact 
with the broader business. There are some organizations that start with a fairly focused view 



around support on traditional functions like marketing, pricing, and other specific areas. And 
then there are other organizations that take a much broader view of the business. I think you 
have to define that element first. 

That helps best inform the appropriate structure, the forums, and then ultimately it sets the 
more granular levels of operation such as training, recruitment, and so forth. But alignment 
around how you’re going to drive the business and the way you’re going to interact with the 
broader organization is absolutely critical. From there, everything else should fall in line. That’s 
how we started with our path. 

Vince Campisi, chief information officer, GE Software: One of the things we’ve learned is 
when we start and focus on an outcome, it’s a great way to deliver value quickly and get 
people excited about the opportunity. And it’s taken us to places we haven’t expected to go 
before. So we may go after a particular outcome and try and organize a data set to 
accomplish that outcome. Once you do that, people start to bring other sources of data and 
other things that they want to connect. And it really takes you in a place where you go after a 
next outcome that you didn’t anticipate going after before. You have to be willing to be a little 
agile and fluid in how you think about things. But if you start with one outcome and deliver it, 
you’ll be surprised as to where it takes you next. 

Ash Gupta, chief risk officer, American Express: The first change we had to make was just 
to make our data of higher quality. We have a lot of data, and sometimes we just weren’t using 
that data and we weren’t paying as much attention to its quality as we now need to. That was, 
one, to make sure that the data has the right lineage, that the data has the right permissible 
purpose to serve the customers. This, in my mind, is ajourney. We made good progress and 
we expect to continue to make this progress across our system. 

The second area is working with our people and making certain that we are centralizing some 
aspects of our business. We are centralizing our capabilities and we are democratizing its use. 
I think the other aspect is that we recognize as a team and as a company that we ourselves do 
not have sufficient skills, and we require collaboration across all sorts of entities outside of 
American Express. This collaboration comes from technology innovators, it comes from data 
providers, it comes from analytical companies. We need to put a full package together for our 
business colleagues and partners so that it’s a convincing argument that we are developing 
things together, that we are colearning, and that we are building on top of each other. 



Examples of impact 


Victor Nilson, senior vice president, big data, AT&T: We always start with the customer 
experience. That’s what matters most. In our customer care centers now, we have a large 
number of very complex products. Even the simple products sometimes have very complex 
potential problems or solutions, so the workflow is very complex. So how do we simplify the 
process for both the customer-care agent and the customer at the same time, whenever 
there’s an interaction? 

We’ve used big data techniques to analyze all the different permutations to augment that 
experience to more quickly resolve or enhance a particular situation. We take the complexity 
out and turn it into something simple and actionable. Simultaneously, we can then analyze 
that data and then go back and say, “Are we optimizing the network proactively in this 
particular case?” So, we take the optimization not only for the customer care but also for the 
network, and then tie that together as well. 

Vince Campisi: I’ll give you one internal perspective and one external perspective. One is we 
are doing a lot in what we call enabling a digital thread—how you can connect innovation 
through engineering, manufacturing, and all the way out to servicing a product. [For more on 
the company’s “digital thread” approach, see “ GE’s Jeff Immelt on digitizing in the industrial 
space.”] And, within that, we’ve got a focus around brilliant factory. So, take driving supply- 
chain optimization as an example. We’ve been able to take over 60 different silos of 
information related to direct-material purchasing, leverage analytics to look at new 
relationships, and use machine learning to identify tremendous amounts of efficiency in how 
we procure direct materials that go into our product. 

An external example is how we leverage analytics to really make assets perform better. We 
call it asset performance management. And we’re starting to enable digital industries, like a 
digital wind farm, where you can leverage analytics to help the machines optimize themselves. 
So you can help a power-generating provider who uses the same wind that’s come through 
and, by having the turbines pitch themselves properly and understand how they can optimize 
that level of wind, we’ve demonstrated the ability to produce up to 10 percent more 
production of energy off the same amount of wind. It’s an example of using analytics to help a 
customer generate more yield and more productivity out of their existing capital investment. 




Winning the talent war 

Ruben Sigala: Competition for analytical talent is extreme. And preserving and maintaining a 
base of talent within an organization is difficult, particularly if you view this as a core 
competency. What we’ve focused on mostly is developing a platform that speaks to what we 
think is a value proposition that is important to the individuals who are looking to begin a 
career or to sustain a career within this field. 

When we talk about the value proposition, we use terms like having an opportunity to truly 
affect the outcomes of the business, to have a wide range of analytical exercises that you’ll be 
challenged with on a regular basis. But, by and large, to be part of an organization that views 
this as a critical part of how it competes in the marketplace—and then to execute against that 
regularly. In part, and to do that well, you have to have good training programs, you have to 
have very specific forms of interaction with the senior team. And you also have to be a part of 
the organization that actually drives the strategy for the company. 

Murli Buluswar: I have found that focusing on the fundamentals of why science was created, 
what our aspirations are, and how being part of this team will shape the professional evolution 
of the team members has been pretty profound in attracting the caliber of talent that we care 
about. And then, of course, comes the even harder part of living that promise on a day-in, day- 
out basis. 

Yes, money is important. My philosophy on money is I want to be in the 75th percentile range; I 
don’t want to be in the 99th percentile. Because no matter where you are, most people- 
especial ly people in the data-science function—have the ability to get a 20 to 30 percent 
increase in their compensation, should they choose to make a move. My intent is not to try 
and reduce that gap. My intent is to create an environment and a culture where they see that 
they’re learning; they see that they’re working on problems that have a broader impact on the 
company, on the industry, and, through that, on society; and they’re part of a vibrant team that 
is inspired by why it exists and how it defines success. Focusing on that, to me, is an 
absolutely critical enabler to attracting the caliber of talent that I need and, for that matter, 
anyone else would need. 


Developing the right expertise 



Victor Nilson: Talent is everything, right? You have to have the data, and, clearly, AT&T has a 
rich wealth of data. But without talent, it’s meaningless. Talent is the differentiator. The right 
talent will go find the right technologies; the right talent will go solve the problems out there. 

We’ve helped contribute in part to the development of many of the new technologies that are 
emerging in the open-source community. We have the legacy advanced techniques from the 
labs, we have the emerging Silicon Valley. But we also have mainstream talent across the 
country, where we have very advanced engineers, we have managers of all levels, and we 
want to develop their talent even further. 

So we’ve delivered over 50,000 big data related training courses just this year alone. And 
we’re continuing to move forward on that. It’s a whole continuum. It might be just a one-week 
boot camp, or it might be advanced, PhD-level data science. But we want to continue to 
develop that talent for those who have the aptitude and interest in it. We want to make sure 
that they can develop their skills and then tie that together with the tools to maximize their 
productivity. 

Zoher Karu: Talent is critical along any data and analytics journey. And analytics talent by 
itself is no longer sufficient, in my opinion. We cannot have people with singular skills. And the 
way I build out my organization is I look for people with a major and a minor. You can major in 
analytics, but you can minor in marketing strategy. Because if you don’t have a minor, how are 
you going to communicate with other parts of the organization? Otherwise, the pure data 
scientist will not be able to talk to the database administrator, who will not be able to talk to 
the market-research person, who which will not be able to talk to the email-channel owner, 
for example. You need to make sound business decisions, based on analytics, that can scale. 



Straight talk about big data 


T he revolution isn’t coming— it’s already under way. In the science of management, 
the revolution in big data analytics is starting to transform how companies organize, 
operate, manage talent, and create value. Changes of this magnitude require leadership from 
the top, and CEOs who embrace this opportunity will increase their companies’ odds of long¬ 
term success. Those who ignore or underestimate the eventual impact of this radical shift— 
and fail to prepare their organizations for the transition—do so at their peril. 

It’s easy to see how analytics could get delegated or deprioritized: CEOs are on the hook for 
performance, and for all of the potential associated with analytics, many leaders operating in 
the here and now are reporting underwhelming results. In fact, when we surveyed a group of 
leaders from companies that are committed to big data-analytics initiatives, three-quarters 
of them reported that their revenue or cost improvements were less than 1 percent. Some of 
the disconnect between promise and payoff may be attributed to undercounting—the sum of 
the parts is not always immediately apparent. Ironically, the results of “big data” analytics are 
often thousands—or more—of incrementally small improvements realized system-wide. 
Individually, any one of these gains may appear insignificant, but when considered in the 
aggregate they can pack a major punch. 





The shortfalls, however, are more than just a matter of perception, and the pitfalls are real. 
Critically, an analytics-enabled transformation is as much about a cultural change as it is 
about parsing the data and putting in place advanced tools. “This is something I got wrong,” 
admits Jeff Immelt, the CEO of GE. “I thought it was all about technology. I thought if we hired 
a couple thousand technology people, if we upgraded our software, things like that, that was 
it. I was wrong. Product managers have to be different; salespeople have to be different; on¬ 
site support has to be different.” 

CEOs who are committed to a shift of this order, yet wonder how far the organization has truly 
advanced in its data-analytics journey to date, should start by stimulating a frank discussion 
with their top team. That includes a clear-eyed assessment of the fundamentals, including 
your company’s key value drivers, your organization’s existing analytics capabilities, and, 
perhaps most important, your purpose for committing to analytics in the first place. (See 
“ Making data analytics work for you—instead of the other way around.”) This article poses 
questions—but not shortcuts—to help a company’s senior leaders determine where they are 
and what needs to change for their organization to deliver on the promise of advanced 
analytics. 

Two scenes from the front lines of the 
revolution 

Immelt reached his conclusions from witnessing—and, in many respects, leading—the 
revolution. GE’s CEO is keenly aware that so far in the 21st century, the digitization of 
commerce and media has allowed a handful of US Internet stalwarts to capture almost all the 
market value created in the consumer sector. To avoid a similar disruption as the industrial 
world goes online over the coming decade, Immelt is driving a radical shift in the culture and 
business model of his 124-year-old company. GE is spending $1 billion this year alone to 
analyze data from sensors on gas turbines, jet engines, oil pipelines, and other machines and 
aims to triple sales of software products by 2020 to roughly $15 billion. To make sense of 
those new streams of data, the company is also building a cloud-based platform called 
Predix, which combines its own information flows with customer data and submits them to 
analytics software that can lower costs and increase uptime through vastly improved 
predictive maintenance. Getting this right will require hiring several thousand new software 
engineers and data scientists, retraining tens of thousands of salespeople and support staff, 




and fundamentally shifting GE’s business model from product sales coupled with service 
licenses to outcomes-based subscription pricing. “We want to treat analytics like it’s as core 
to the company over the next 20 years as material science has been over the past 50 years,” 
says Immelt. 

To understand further the growing power of advanced analytics, consider as well how a 
consumer-electronics OEM is picking up more speed in an inherently slow-growth market. 
The company started with a Herculean effort to pull together information on more than 1,000 
variables previously collected in silos across millions of devices and sources—product sales 
and usage data, channel data, online transactions, and service tickets, plus external consumer 
data from third-party suppliers such as Acxiom. Mining this integrated big data set allowed 
the company to home in on a dozen or so unrealized opportunities where a shift in investment 
patterns or processes would really pay off. Armed with a host of new, fine-grained insights on 
which moves offered the greatest odds to increase sales, reduce churn, and improve product 
features, the company went on to realize $400 million in incremental revenue increases in 
year one. As success builds, the leadership has begun to fundamentally rethink how it goes 
about new-business development and what future capabilities its top managers will require. 

Big challenges, bigger opportunities 

But for all the enormous promise, most companies—outside of a few digital natives such as 
Amazon, Facebook, Google, Netflix, and Uber—have so far struggled to realize anything more 
than modest gains from their investments in big data, advanced analytics, and machine 
learning. Many organizations remain preoccupied with classic large-scale IT-infrastructure 
programs and have not yet mastered the foundational task of creating clean, powerful, linked 
data assets; building the capabilities they need to extract insight from them; and creating the 
management capacity required to lead and direct all this toward purposeful action (exhibit). 



Exhibit 


Data analytics should have a purpose, be grounded in the right 
foundation, and always be conducted with adoption in mind. 
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Adoption Make adoption your deliverable 


Integrate insights into real-life workflows and 
processes; create user-friendly interfaces 
and platforms 


Observe, orient, decide, act; incorporate 
feedback and repeat 

Apply data to specific value-creating 
use cases; run pilots that measure impact 
by clear metrics 


Capture all data points pertinent to core 
processes and key use cases, whether 
internal, external, hard, or “fuzzy” 

Create data provenance models; 
employ a variety of analytical tools 
and methodologies 

Instill a company-wide data 
orientation; build teams with 
complementary data skills 



Technology and infrastructure 


Organization and governance 


Still, similar birthing pains have marked every previous major technology transition as well. 
And we’re still in the early days of this one: though about 90 percent of the digital data ever 
created in the world has been generated in just the past two years, only 1 percent of that data 
has been analyzed. Often, those analyses are conducted as discrete one-offs—nifty 
experiments, but not much more. Indeed, in many companies, analytics initiatives still seem 
more like sideline science-fair projects than the core of a cutting-edge business model. 

But the potential for significant breakthroughs demands an overhaul of that model, and the 
speed at which these breakthroughs advance will only accelerate. As computer-processing 
power and cloud-storage capacity swell, the world’s current data flood becomes a tidal wave. 




By 2020, some 50 billion smart devices will be connected, along with additional billions of 
smart sensors, ensuring that the global supply of data will continue to more than double every 
two years. 


Leading questions 

All of these developments ensure that there will be a lot of data to analyze. Almost by 
definition, big data analytics means going deep into the information weeds and crunching the 
numbers with a technical sophistication that can appear so esoteric that senior leadership 
may be tempted simply to “leave it to the experts” and disengage from the conversation. But 
the conversation is worth having. The real power of analytics-enabled insights comes when 
they become so fully embedded in the culture that their predictions and prescriptions drive a 
company’s strategy and operations and reshape how the organization delivers on them. 
Extending analytics from the realm of tactical insights into the heart of the business requires 
hard work, but the benefits can be profound. Consider, for example: 

• A global airline stitched together data from multiple operational systems (including 
those related to aircraft location and aerobridge position) to identify more precisely 
when and why flights were delayed as they pushed back or arrived at a gate. Its 
advanced prediction algorithms were able to quantify the knock-on impact of events 
such as mishandled luggage and helped build a system to alert supervisors in real time 
so that they could react before potential problems developed. Impact: a reduction in 
delayed arrivals of about 25 percent over the past 12 months. 

• A global consumer-packaged-goods company seeking to drive growth across 
categories integrated a wide range of information (including financial, promotional, and 
even weather-related factors) into a single data source and then developed 
sophisticated algorithms to understand the incremental effects that changes based on 
this source could have at even granular levels. Sifting through disparate data and 
building up from the ground level enabled the company to identify valuable insights 
about its competitive landscape as a whole, such as optimal price points and 
opportunities for new products. Impact: a gross-profit increase in the tens of millions of 
dollars within one year. 



• A pharmaceuticals company is using analytics to stem the rising cost of clinical trials. 
After spending billions of dollars conducting hundreds of trials over the past five years, 
the company began integrating information on more than 100,000 patient participants 
with operational data from finance and HR. Out of those tens of millions of data points, 
it has started to pinpoint which locations are most efficient, which patient-screening 
techniques increase “pass rates,” and how best to configure its own teams. Analysis of 
email and calendar data, for example, underscored that improving collaboration 
between a team leader and two specific roles within clinical operations was among the 
most significant predictors of delays. The anticipated result: cost savings of more than 
10 percent and better-quality outcomes. 

And the list goes on: case after case of reduced churn, less fraud, improved collections, better 
return on investment from marketing and customer acquisition, and enhanced predictive 
maintenance. Right now, only a few leaders outside the tech sector are truly transforming 
their organizations with data. But more could be. To that end, we suggest five questions that 
company leaders should be prepared to explore in depth. 

1. Do we have a value-driven analytics 
strategy? 


Businesses can waste a lot of energy collecting data and mining them for insights if their 
efforts aren’t focused on the areas that matter most for the company’s chosen direction. 
Successful big data and advanced-analytics transformations begin with assessing your own 
value drivers and capabilities versus those of the competition and developing a picture of the 
ideal future state, one aligned with the broad business strategy and key use cases. Asking the 
right questions is the critical first step. These should start big: “What is the size of this 
opportunity? If I had the additional insights possible through advanced analytics, how much 
could I save? How much additional revenue could I achieve?” And they should quickly get 
granular. To frame and develop the right hypotheses, frontline managers must engage 
alongside the analytics experts throughout the process. 

That consumer-electronics OEM’s planning exercise, for example, led the team to ask several 
questions: “Who are our highest-value customers, how do we reach them, and what do we 
talk about? How can we drive more cross-sell of our broader portfolio of products and 



services? Which product features drive the highest usage or engagement, and how do we 
promote higher adoption of them?” At a leading private bank, the questions from a similar 
exercise included these: “How can we set optimal price points, day in and day out, and by the 
thousands each day? Which customers are most at risk of leaving, which are most likely to 
respond favorably to retention efforts, and what types of retention efforts work best?” 

2. Do we have the right ‘domain data’ to 
support our strategy? 


In answering such questions, companies typically identify 10 to 20 key use cases in areas 
such as revenue growth, customer experience, risk management, and operations where 
advanced analytics could produce clear-cut improvements. On the basis of that self- 
assessment and the anticipated impact on earnings, the use cases are ranked and pilot 
projects are sequenced. Measuring the impact of each use case, with specific indicators and 
benchmarks, highlights what data are needed and keeps things on track. 

A critical foundational step is to overcome obstacles to using existing data. This work could 
include cleaning up historical data, integrating data from multiple sources, breaking down 
silos between business units and functions, setting data-governance standards, and deciding 
where the most important opportunities may lie to generate new internal data—for example, 
by adding sensors, or, in the case of, say, casinos, by installing webcams to assess high-roller 
betting behavior. 

Most companies, even those with rich internal data, will also conclude they need to mine the 
far-larger universe of structured and unstructured external sources. When one emerging- 
markets insurer decided to launch a new peer-to-peer-lending start-up, it realized it could 
make even better credit decisions by analyzing potential customers’ data and movements on 
its various platforms, including social networks. 

All these data eventually can be pooled into more shareable, accessible assets, such as new 
“data lakes.” Getting the foundation sorted is not the work of weeks or even months, as 
anyone who has wrestled with the shortcomings of legacy IT systems knows. And the cost 
can eventually run into hundreds of millions of dollars, while the full impact of those 




investments will not always be obvious in one quarter, or two, or three. But that doesn’t mean 
you should wait for years to capture value. Which makes it all the more important to ask the 
next question. 


3. Where are we in our journey? 

Like any transition, the data-and-analytics journey takes place in stages. It’s crucial both to 
start laying the foundation and to start building analytics capabilities even before the 
foundation is set. Or, as one of our clients recently recalled as he thought about his company’s 
successful analytics transformation: “We needed to walk before we could run. And then we 
ran like hell.” 

To step smartly in fast-forward mode, the consumer-electronics OEM created an interim data 
architecture focused on building and staffing three “insights factories” that could generate 
actionable recommendations for its highest-priority use cases. While further foundational 
investments continued in parallel, those factories enabled the early pilots to deliver quick 
results that made them largely self-funding. The key is to move quickly from data collection to 
“doing the math,” with an iterative, hypothesis-driven modeling cycle. Such rapid successes 
help break down silos and build enthusiasm and buy-in among often skeptical frontline 
managers. Even if it works, a “black box” developed by data scientists working in isolation will 
usually prove a recipe for rejection. End users need to understand the basic assumptions and 
how to apply the model’s output: Are its recommendations binding, or is there flexibility to 
deviate? Will it be integrated directly into core tools such as customer relationship 
management, or will it be an additional overlay? What visual display will be most useful for the 
front line—in general, simpler is better—once the data are produced? Pilots should be 
designed to answer these questions even before the data are collected and the model is built. 

Once proof of concept is established and points start going on the board, it’s critical to go big 
as quickly as possible, which can require an infusion of talent. Best-practice companies rarely 
cherry-pick one or two specialist profiles to recruit to address isolated challenges. In our 
recent survey of more than 700 companies, we found that 15 percent of operating-profit 
increases were linked to the hiring of data-and-analytics experts at scale. 



4. Are we modeling the change 
personally? 


In a recent survey of more than 500 executives, we turned up a distressing finding: while 38 
percent of CEOs self-reported that they were leading their companies’ analytics agendas, 
only 9 percent of the other C-suite executives agreed. They instead identified the chief 
information officer or some other executive as the true point person. What we’ve got here, to 
paraphrase the warden in Cool Hand Luke , is more than a failure to communicate; it’s about 
not walking the talk. 

While CEOs and other members of the executive team don’t need to be the experts on data 
science, they must at least become conversant with a jungle of new jargon and buzzwords 
(Hadoop, genetic algorithms, in-memory analytics, deep learning, and the like) and 
understand at a high level the limits of the various kinds of algorithmic models. In addition to 
constant communication from the top that analytics is a priority and public celebration of 
successes, small signals such as recommending and showing up for learning opportunities 
also resonate. 

The most important role modeling a CEO can deliver, of course, is to ensure that the right kind 
of conversations are taking place among the company’s top management. That starts with 
ensuring that the right people are both in the room and empowered, and then continues with 
direct intervention and questioning to ensure the transition from experience-based decision 
making to data-based decision making: Was a conclusion A/B tested? What have we done to 
build up our capability to conduct rapid prototyping, to test and learn and experiment, to 
constantly engage in what Google chief economist Hal Varian calls “product kaizen”? 

5. Are we organizing and leading for 
analytics? 

The most important shift, which only the CEO can lead, is to reorganize to put advanced 
analytics at the center of every core process. The aspiration, in fact, should be to eventually 
eliminate the distinct term “analytics” from the company lexicon. Data flow through the whole 



organization, and the analytics should organically follow. “I just think it’s infecting everything 
we do, in a positive way,” says GE’s Immelt. 

Still, even a central nervous system requires a brain—a central analytics hub, or center of 
excellence. Without a dedicated team and leader, whether a chief analytics officer or a chief 
data officer or a senior C-level executive clearly tasked with the role, companies struggle to 
create a distinctive culture that can attract and nurture the best talent. But at the same time, 
as with a function like finance, individuals connected with the central team should also be 
embedded in the separate business units. We’ve found that executives from companies with a 
hybrid model reported a greater impact from analytics on revenue and costs than other 
respondents did. 

What additional roles, skills, and structures are necessary? Clearly, scaling up analytics 
requires recruiting and retaining a sufficient number of world-class data scientists and model 
builders. Buying such talent on an outsourced model is only an option for those still in the 
exploratory phase of their journey. But, to take one example, most banks in the post-stress- 
test world have created separate, in-house units with their own reporting lines, charged with 
constantly testing and validating those models to minimize the risk of spurious correlations. 
We believe this approach makes sense for nonbanks as well. 

To turn modeling outputs, however robust, into tangible business actions, companies also 
need a sufficient supply of “translators,” people able to connect the needs of the business 
units with the technical skills of the modelers. Don’t assume such “two sport” leaders are easy 
to find. In our experience, executives often report that attracting and retaining business users 
with analytics skill sets is actually slightly harder than recruiting those in-demand data 
scientists themselves. Alongside aggressive recruiting, winning this war for talent requires 
doubling down on training and improved HR analytics. 

In general, most organizations are underinvesting in creating intuitive tools with easy-to-use 
interfaces that can help frontline managers integrate data into day-to-day processes. Our 
rule of thumb: for the highest payoff, split your analytics investments roughly 50-50 between 
spending on building better models and spending on tools and training to ensure that the 
front line uses the new insights being generated. In many companies, that ratio is still closer to 
80-20, or worse. 



Beyond big data and analytics, an even broader shift is under way, as robots, machine¬ 
learning algorithms, and “soft Al” systems, such as IBM’s Watson, take on more and more of 
the tasks that human labor used to conduct. Early in 2016, AlphaGo, a system developed by 
DeepMind, a British company owned by Google, unexpectedly rolled over a celebrated 
human champion in the ancient game of Go. To prepare for a contest in which, unlike chess, 
there are more possible positions than grains of sand in the universe, AlphaGo trained itself 
by playing endless rounds of games, which enabled the path-optimization strategies. 

As the use of data and analytics incorporates machine learning, and artificial intelligence 
continues to blur, humans can take comfort from one near certainty: as proved true in chess 
after 1997, when IBM’s Deep Blue defeated Garry Kasparov, the new “best players” of Go will 
turn out to be neither humans nor machines alone, but rather humans working in tandem with 
machines. Mastering how to leverage that combination may be the ultimate CEO 
management challenge. 


Science-fiction writer Arthur C. Clarke once said that “any sufficiently advanced technology is 
indistinguishable from magic.” We haven’t advanced to that level—yet. But as the age of big 
data gives way to the age of advanced analytics and machine learning, we are entering an era 
where the ability to analyze data will deliver a predictive capability that feels almost like magic. 

As in other historic shifts, such as when modern firearms “disrupted” the crossbow, the 
competition between those who master the new technology and those who don’t will be 
fierce. But the upside of adaptation is as inspiring as the downside is stark. In the years 
ahead, the companies and institutions that address these challenges frankly, transform their 
organizations accordingly, and apply these near-magical abilities seamlessly to the world’s 
most complex and critical issues will deliver a level of value creation that today we can barely 
imagine. 



Leadership and behavior: Mastering 
the mechanics of reason and emotion 


A Nobel Prize winner and a leading behavioral economist offer common 
sense and counterintuitive insights on performance, collaboration, and 
innovation. 


T he confluence of economics, psychology, game theory, and neuroscience has 
opened new vistas—not just on how people think and behave, but also on how 
organizations function. Over the past two decades, academic insight and real-world 
experience have demonstrated, beyond much doubt, that when companies channel their 
competitive and collaborative instincts, embrace diversity, and recognize the needs and 
emotions of their employees, they can reap dividends in performance. 

The pioneering work of Nobel laureate and Harvard professor Eric Maskin in mechanism 
design theory represents one powerful application. Combining game theory, behavioral 
economics, and engineering, his ideas help an organization’s leaders choose a desired result 
and then design game-like rules that can realize it by taking into account how different 
independently acting, intelligent people will behave. The work of Hebrew University professor 
Eyal Winter challenges and advances our understanding of what “intelligence” really means. 

In his latest book, Feeling Smart: Why Our Emotions Are More Rational Than We Think 
(PublicAffairs, 2014), Winter shows that although emotions are thought to be at odds with 
rationality, they’re actually a key factor in rational decision making. 




In this discussion, led by McKinsey partner Julia Sperling, a medical doctor and neuroscientist 
by training, and McKinsey Publishing’s David Schwartz, Maskin and Winter explore some of 
the implications of their work for leaders of all stripes. 


The Quarterly. Should CEOs feel badly about following their gut or at least listening to their 
intuition? 

Eyal Winter: A CEO should be aware that whenever we make an important decision, we 
invoke rationality and emotion at the same time. For instance, when we are affected by 
empathy, we are more capable of recognizing things that are hidden from us than if we try to 
use pure rationality. And, of course, understanding the motives and the feelings of other 
parties is crucial to engaging effectively in strategic and interactive situations. 

Eric Maskin: I fully agree with Eyal, but I want to introduce a qualification: our emotions can 
be a powerful guide to decision making, and in fact they evolved for that purpose. But it’s not 
always the case that the situation that we find ourselves in is well matched to the situation 
that our emotions have evolved for. For example, we may have a negative emotional reaction 
on meeting people who, at least superficially, seem very different from us—“fear of the other.” 
This emotion evolved for a good purpose; in a tribal world, other tribes posed a threat. But 
that kind of emotion can get in the way of interactions today. It introduces immediate hostility 
when there shouldn’t be hostility. 

The Quarterly. That really matters for diversity. 

Eyal Winter: One of the most important aspects of this interaction is that rationality allows us 
to analyze our emotions and gives us answers to the question of why we feel a certain way. 
And it allows us to be critical when we’re judging our own emotions. 

People have a perception about decision making, as if we have two boxes in the brain. One is 
telling the other that it’s irrational, these two boxes are fighting over time, one is prevailing— 
and then we make decisions based on the prevailing side, or we shut down one of these 
boxes and make decisions based on the other one only. This is a very wrong way of describing 
how people make decisions. There is hardly any decision that we take that does not involve 
the two things together. Actually, there’s a lot of deliberation between rationality and emotion. 
And we also know that the types of decisions that invoke perhaps the most intensive 
collaboration between rationality and emotions are ethical or moral considerations. As a 



neuroscientist, you know that one of the more important pieces of scientific evidence for this 
is that much of this interaction takes place in the part of the brain called the prefrontal cortex. 
When we confront people with ethical issues, this part of the brain, the prefrontal cortex, is 
doing a lot of work. 

The Quarterly. Yes, and we can track this with imaging techniques. Indeed, neuroscientists 
keep fighting back when people try too quickly to take insights from their area of science into 
business, and come up with this idea of a “left-” and “right-brain” person, and exactly the 
boxes that you are mentioning. Given your earlier comments, do you believe we are capable in 
a situation where we are emotional, to actually step back, look at ourselves, realize that we are 
acting in an emotional way—and that this behavior might be either appropriate or not 
appropriate? 

Eyal Winter: I think we are capable of doing it, and we are doing it to some extent. Some 
people do it better, some people have more difficulty. But just imagine what would have 
happened if we couldn’t have done it? We probably wouldn’t have managed, in terms of 
evolution. I think that the mere fact that we still exist, you and me, shows that we have some 
capability of controlling our emotions. 

Eric Maskin: In fact, one interesting empirical trend that we observe through the centuries is 
a decline of violence, or at least violence on a per capita basis. The world is a much less 
dangerous place now than it was 100 years ago. The contrast is even bigger when we go back 
longer periods of time. And this is largely because of our ability over time to develop, first, an 
awareness of our hostile inclinations, but more important to build in mechanisms which 
protect us from those inclinations. 

The Quarterly. Can you speak more about mechanism design—how important it is that 
systems help the individual or groups to act in ways that are desirable? 

Eric Maskin: Mechanism design recognizes the fact that there’s often a tension between 
what is good for the individual, that is, an individual’s objectives, and what is good for society 
—society’s objectives. And the point of mechanism design is to modify or create institutions 
that help bring those conflicting objectives into line, even when critical information about the 
situation is missing. 



An example that I like to use is the problem of cutting a cake. A cake is to be divided between 
two children, Bob and Alice. Bob and Alice’s objectives are each to get as much cake as 
possible. But you, as the parent—as “society”—are interested in making sure that the division 
is fair, that Bob thinks his piece is at least as big as Alice’s, and Alice thinks her piece is at 
least as big as Bob’s. Is there a mechanism, a procedure, you can use that will result in a fair 
division, even when you have no information about how the children themselves see the cake? 

Well, it turns out that there’s a very simple and well-known mechanism to solve this problem, 
called the “divide and choose” procedure. You let one of the children, say, Bob, do the cutting, 
but then allow the other, Alice, to choose which piece she takes for herself. The reason why 
this works is that it exploits Bob’s objective to get as much cake as possible. When he’s 
cutting the cake, he will make sure that, from his point of view, the two pieces are exactly 
equal because he knows that if they’re not, Alice will take the bigger one. The mechanism is 
an example of how you can reconcile two seemingly conflicting objectives even when you 
have no idea what the participants themselves consider to be equal pieces. 

The Quarterly: How has mechanism theory been applied by leaders or organizations? 

Eric Maskin: It’s found applications in many areas, including within companies. Say that 
you’re a CEO and you want to motivate your employees to work hard for the company, but 
you’re missing some critical information. In particular, you can’t actually observe directly what 
the employees are doing. You can observe the outcomes of their actions—sales or revenues 
—but the outcomes may not correlate perfectly with the inputs—their efforts—because other 
factors besides employees’ efforts may be involved. The problem for the CEO, then, is how do 
you reward your employees for performance when you cannot observe inputs directly? 

Eyal Winter: Here’s an example: Continental Airlines was on the verge of bankruptcy in the 
mid-’90s. And an important reason was very bad on-time performance—it caused 
passengers to leave the company. Continental was thinking both about the incentives for the 
individuals and, more importantly, about on-time performance. It’s a “weak link” type of 
technology. If one worker stalls, the entire process is stopped because it’s a sequential 
process, where everybody’s dependent on everybody else. 

What they came up with was the “go forward” plan, which offered every employee in the 
company a $65 bonus for every month in which the company ranking on on-time 
performance was in the top five. Just $65, from the cleaners up to the CEO. It sounds 



ridiculous, because $65 a month seems not enough money to incentivize people to work 
hard, but it worked perfectly. 

The main reason was that Continental recognized that there’s an aspect to incentives which is 
not necessarily about money. In this case, shirking would mean that you lose your own bonus 
of $65, but it would also mean that you will be in a situation in which you will feel you are 
causing damage to thousands of employees that didn’t receive a bonus that month because 
you stalled. It was the understanding that incentives can be also social, emotional, and moral 
that made this mechanism design work perfectly. 

Eric Maskin: A related technique is to make employees shareholders in the company. You 
might think that in a very large company an individual employee’s effect on the share price 
might be pretty small—but as Eyal said, there’s an emotional impact too. An employee’s 
identity is tied to this company in a way that it wouldn’t be if she were receiving a straight 
salary. And empirical studies by the labor economist Richard Freeman and others show that 
even large companies making use of employee ownership have higher productivity. 

The Quarterly. How would you advise leaders to facilitate group collaborations, especially in 
organizations where people feel strong individual ownership? 

Eyal Winter: It’s again very much about incentives. One has to find the right balance between 
joint interest and individual interest. For example, businesses can overemphasize the role of 
individual bonuses. Bonuses can be counterproductive when they generate aggressive 
competition in a way which is not healthy to the organization. 

There are interesting papers about team behavior, and we know that bonuses for combined 
individuals, or bonus schemes that combine some individual points with some collective 
points, or which depend on group behavior as a whole, often work much more effectively than 
individual bonuses alone. The balance between competition and cooperation is something 
that CEOs and managers have to think deeply about, by opting for the right mechanism. 

The Quarterly. Can mechanisms that encourage collaboration also be used to foster 
innovation? 

Eric Maskin: Collaboration is a powerful tool for speeding up innovation, because innovation 
is all about ideas. If you have an idea and I have an idea, then if we’re collaborating we can 
develop the better idea and ignore the worse idea. But if we’re working alone, then the worse 



idea doesn’t get discarded, and that slows down innovation. 


Collaboration in academic research shows an interesting trend. If you look at the list of papers 
published in economics journals 30 years ago, you’ll find that most of them were single- 
authored. Now the overwhelming majority of such papers, probably 80 percent or more, are 
multiauthored. And there’s a very good reason for that trend: in collaborative research, the 
whole is more than the sum of the parts because only the best ideas get used. 

Eyal Winter: There’s another aspect in the working environment which is conducive to 
innovation. And that is whether the organization will be open to risk taking by employees. If 
you’re coming with an innovative idea, not a standard idea, there is a much greater risk that 
nothing will come out of it eventually. If people work in an environment which is not open for 
taking risks, or alternatively in which they have to fight for survival within their organization, 
they will be much less prone to take the risks that will lead to innovation. 

The Quarterly: What about innovation in a world of vast amounts of data and advanced 
analytics at our fingertips? Is there untapped potential here for behavioral economics? 

Eric Maskin: One exciting direction is randomized field experiments. Up until now, most 
experiments in behavioral economics have been done in the lab. That is, you put people in an 
artificial setting, the laboratory, and you see how they behave. But when you do that, you 
always worry about whether your insights apply to the real world. 

And this is where randomized field experiments come in. Now you follow people in their actual 
lives, rather than putting them in the lab. That gives you less control over the factors 
influencing behavior than you have in the lab. But that’s where big data help. If you have large 
enough data sets—millions or billions of pieces of information—then the lack of control is no 
longer as important a concern. Big data sets help compensate for the messiness of real-life 
behavior. 

The Quarterly: Big data analytics is also tapping into artificial intelligence. But can a 
computer be programmed to reason morally, as people do—and how might that play out? 

Eyal Winter: I think there will be a huge advancement in Al. But I don’t believe that it will 
replace perfectly or completely the interaction between human beings. People will still have 
to meet and discuss things, even with machines. 



Eric Maskin: Humans are instinctively moral beings and I don’t see machines as ever entirely 
replacing those instincts. Computers are powerful complements to moral reasoning, not 
substitutes for it. 



Sustainable compliance: Seven steps 
toward effectiveness and efficiency 


Banks do not control the demand for compliance, but they can optimize 
the effectiveness and efficiency of their response. 


T he cost of regulatory compliance in banking rose dramatically in the years after the 
financial crisis. Some of the increase came from investment in technology, but most of 
it was—and remains—driven by additional staff. The crisis triggered numerous critical control 
failures that required immediate remedy. Institutions responded, appropriately enough given 
the urgency, by adding layers of control. An idea of what resulted can be seen in a typical 
example. At a large universal bank, a quarter of one business unit’s resources is now 
dedicated to control, significantly reducing the share focused on the business (Exhibit 1). 
While the exact numbers will vary by institution and business unit, what’s certain is that more 
resources than ever before are being dedicated to testing, monitoring, and other oversight 
responsibilities—at the expense, given budget limits, of production resources. 



Exhibit 1 


More resources than ever before are being dedicated to 
testing, monitoring, and other oversight responsibilities. 
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The investments have magnified industry resilience and improved the quality of risk 
management. The high cost, however, is now coming into focus. At many financial institutions, 
business, compliance, and risk practitioners are beginning to question the sustainability of the 
resource-intensive approach to managing compliance risks. We believe they are asking the 
right question. Banks are still adding layers of control as the remedy of choice for compliance 
issues. The result is an unwieldy “system” of overlapping controls that is difficult to automate 
and does not address the true root causes of risk. Arising issues are approached one at a time 
and in isolation; remediation efforts are inadequately measured and tracked. 







Fragmented efforts, manual processes, 
mountains of data 

We analyzed the time spent on remediation at one global financial institution according to the 
importance (materiality) of the issue. We found that first- and second-line compliance staff 
were spending 80 percent of this time on issues of low or moderate materiality, and only 20 
percent on critical high-risk issues. The issues were approached individually, according to an 
“issue log” with thousands of entries. Unsurprisingly, separate remediation initiatives and 
audit reports were often directed at the same processes and had the same underlying 
causes. These could have been addressed systematically, but individual projects did not have 
the budget to take that on. Only when the institution took an enterprise-wide view did the 
case for IT investment become clear. 

The status quo approach to compliance does not allow for an integrated view across the 
enterprise. The approach to risk assessment is fragmented: some risks are covered by 
multiple assessments and others not at all. Nor does a consistent understanding of the 
material risks emerge, as the varying standards of materiality and testing produce conflicting 
results across the organization. Compliance, activities relating to banking secrecy and anti¬ 
money laundering (BSA/AML), operational risk, third-party risk, and other assessments are 
performed frequently by separate teams applying different approaches, and much effort is 
expended in reconciling the outputs. At one large financial institution, we found that business 
leadership teams are required to participate in 20 or more risk-assessment activities annually, 
led by the various control functions. Yet despite all this labor, top management still cannot 
obtain a reliable view of the institution’s biggest compliance exposures nor on the state of 
controls governing them. 

Many leading institutions have tried to shift compliance frameworks toward a more risk-based 
approach. They have struggled to escape an orientation to procedural adherence and refocus 
on residual risk (outcomes). Metrics present another challenge. Rather than forward-looking 
measures of risk, many are ill defined and generate data with unclear implications. As 
mountains of details pile up, critical exposures can get lost easily. Legacy controls remain in 
use as new metrics are added. Many intermediate controls and testing can be removed, 
however, as a recent efficiency effort at a bank’s consumer business demonstrated. The 



needed solution (expanded sample-based quality-assurance testing on executed affidavits) 
was simpler, less time consuming, and more effective in disclosing material exposures. And it 
was less costly than the existing haphazard system. 


The value in sustainable compliance 

The aim of a sustainable compliance program is to improve the bank’s risk profile through a 
more effective and efficient compliance function focused on the most important risks. The 
approach both centers on material risk and eliminates inefficient activities. In our experience, 
it can free up to 30 percent of the compliance function’s capacity (Exhibit 2). The size of the 
opportunity depends on the starting point of the bank: leaner institutions will benefit from 
effectiveness improvements, while institutions with heavier quality-assurance, control, and 
audit structures will additionally benefit from meaningful efficiency savings. 



Exhibit 2 


A program for sustainable compliance can free up to 
30 percent of the function’s capacity, improving the 
effectiveness of risk management. 


Potential impact on total compliance capacity 



Harmonize 

risk-man¬ 

agement 

standards 

Impact on 
effectiveness 

Clarify 
responsibili¬ 
ties and 
governance 

Optimize 
capacity 
and cover¬ 
age model 

Streamline 

key 

processes 

Implement 

digitization 

and 

advanced 

analytics 

High 

High 

Moderate 

High 

High 

Consistent 

Correct testing- 

Broader 

Automation of 

Reports 

language 

coverage 

talent pool 

controls and 

focused on 

and taxono- 

model for 


work flow 

factors that 

mies across 

material risks 

Concentra- 


will guide 

enterprise 


tion of 

Standardized 

manage- 


End of dupli- 

skilled 

response to 

ment deci- 

Single 

cate testing 

resources 

material risk 

sions 

inventory of 

of risks and 

performing 

assessments 


material 

risks 

processes 

Clear roles and 
responsibilities 
for all lines of 
defense 

similar tasks 

Better 
responsive¬ 
ness to 
business 
needs 

Standard 
data archi¬ 
tecture (and 
BCBS 239 1 
compliance) 


Total 

impact 


’Basel Committee on Banking Supervision’s regulation number 239. 


One global financial institution recently developed a set of initiatives to free up 20 percent of 
capacity in its risk and compliance functions. The starting point was organizationally heavy: 
the two second-line functions accounted for one-third of corporate function expenses. The 
resource footprint was 95 percent concentrated in high-cost metropolitan areas with very 
competitive talent markets. At the same time, effectiveness was inadequate, as evidenced by 






a growing backlog of regulatory issues and audit findings. Risk-management standards, 
including taxonomies and tolerances, varied across and within lines of defense; “shadow” 
testing and monitoring activities were being performed by business lines (the so-called one- 
and-a-half line of defense); and modeling, analytics, and reporting activities were fragmented 
across the first and second lines. 

The improvement program prioritized initiatives that enhanced the effectiveness of 
compliance and risk-management activities and their efficiency, to achieve a sustainable 
operating model to support future growth. Better effectiveness was sought by taking a 
proactive approach to help the business manage material risks. Rather than reacting to 
issues, the bank would diagnose root causes and translate regulations into operational 
requirements. Effectiveness was further fostered through timely and adequate transparency 
into the state of risks and controls, and increased confidence that no material risk would be 
left unattended. The functions became more efficient through the automation of tasks and 
controls and easier access to qualified talent. The resource footprint was optimized, aligning it 
with business and strategic needs. Resource allocation could then focus on material risks, 
boosting staff productivity. Nonessential work was minimized, including the remediation of 
low-materiality risks. Testing, reporting, and other activities were rationalized across the three 
lines of defense; duplication, especially in the control functions (such as remediation tracking 
and risk identification and assessment), was largely eliminated. 

Building it: Seven steps to sustainable 
compliance 

Compliance practitioners point out that compliance activities are triggered by regulatory 
requirements and by how well businesses manage regulatory risks. Regulatory demands, they 
argue, are outside the control of the compliance function, while the adroit management of 
regulatory risks takes time to mature. In our view, the key to sustainable compliance is how 
well the compliance function responds to these demands. Below we lay out seven practical 
steps that institutions can take to move closer to sustainable compliance. 



1. Transform frontline units into a true 
first line of defense. 

At many institutions, frontline units have “outsourced” a significant portion of their compliance 
responsibilities to the second line of defense, relying on the compliance function for everyday 
compliance-related business and control decisions. At other institutions, both lines of 
defense are involved in similar activities, leading to duplication and fragmentation of effort. 
These two faulty approaches are avoided when roles and responsibilities are appropriately 
defined. There is real value in having a strong first line of defense handling everyday business 
and in-line control activities. The role of the second line varies based on the type of 
compliance requirements. Some regulations can be translated into a set of clear operational 
requirements—this is called “rules-based compliance.” Other regulations, such as consumer 
protections, reflect regulatory intent for a desired outcome. This is called “principles-based 
compliance,” which does not easily convert into specific operational and control requirements. 

For rules-based compliance, the second line needs to define clear standards and shift in-line 
execution and approval (such as consumer disclosures) to the first line of defense. For 
principles-based compliance, some decisions (such as the suitability of marketing materials) 
need to be embedded in the first line with adequate training, certification, and monitoring. 
Conduct risk in retail banking, for example, will present challenges in defining first- and 
second-line roles and testing and monitoring responsibilities. The compliance function will 
need to clearly articulate regulatory requirements for disclosures, adverse action, advertising, 
and privacy—and then provide technical expertise as business lines translate those 
requirements into operational procedures, practices, and controls. Compliance also needs to 
define requirements for training and certification (including in general areas such as product 
design and usage and fair and nondiscriminatory treatment), and ensure that they are met by 
all relevant stakeholders. The execution of control, such as authorizing accounts or approving 
new products, should, however, be embedded in the first-line processes. The second line will 
focus on independent approval and risk-based testing to ensure that controls do indeed work 
as intended. 

As the second line, the compliance function defines and monitors control standards; the 
complementary role for the first line is to manage those controls more strategically. 
Accordingly, the control office in each business unit organizes how the front line manages its 



control environment—the front line reviews the business setup against the controls in the 
context of the inherent risk profile and business complexity. When global banks streamline 
their business footprint (for example, by offering products across markets or the customer 
portfolio), the related business processes and systems become essential in managing the 
inherent risk profile. 

2. De-risk and reengineer business and 
compliance processes. 


The demand for compliance resources can be significantly reduced by reengineering labor- 
intensive activities for core compliance processes, such as onboarding or transaction 
approvals. For control breaches, root-cause analysis is critically important. This will ensure 
that the true underlying drivers will be revealed for effective, lasting remediation. Further 
similar breaches—and the consumption of further resources, such as the addition of more 
checkers—are eliminated by the automation and redesign of the exposure areas. An 
additional important measure is the development of consolidated risk-assessment 
requirements across control functions for key business decisions. This way, duplicate 
functional controls—such as legal, BSA/AML, information security, and compliance 
requirements for new clients—can be eliminated and businesses freed from repetitive 
requests. 

For one wealth-management company, automation of know-your-customer (KYC) controls 
reduced the turnaround time for the new-customer-onboarding process from five or six days 
for the most complex institutional accounts to 24 hours. The cost of KYC was reduced by 
more than 70 percent and the customer experience dramatically enhanced. These savings of 
time and money were possible because the institution tackled KYC requirements, along with 
credit-process digitization, as an integrated reengineering and automation program. The 
initiative was built on the understanding that the end-to-end process is no faster than its 
weakest link—which is often the compliance requirements. 


3. Optimize the compliance operating 
model. 



The compliance resources needed to support the business units can be configured most 
effectively and efficiently by consolidating subject-matter expertise and core activities in 
centers of excellence and utilities. This will help ensure that the best expertise is applied 
across channels in business-unit-facing compliance teams. Additionally, the opportunity in 
optimizing the location strategy for compliance is often sizable. A new look at location could 
lead to lower structural costs for compliance and offer access to global talent markets to 
tackle the challenges posed by talent scarcity in traditional locations. A diversified geographic 
footprint also ensures greater resilience in the face of adverse business or market events. 

4. Focus on what matters. 

Compliance with laws, rules, and regulations is viewed by banks as a zero-tolerance activity. 
Nevertheless, the time spent on each compliance demand must be differentiated according 
to the bank’s highest sensitivities and biggest risks in noncompliance. Time and resources, 
that is, should be allocated to the risks that matter most. Usually at the top of the list are 
finance laws and customer and market conduct. 

Detailed adjustments can be made in the frequency of testing and sample sizes, depending 
on the level of inherent exposure in a given operational area. Moreover, testing and 
remediation activities can be risk-ranked and embedded in resource- and investment- 
allocation processes. Compliance priorities can then be regularly reassessed to account for 
new risks, defective controls, and business or regulatory changes. 

Ongoing prioritization based on risk requires that organizations objectively measure residual 
risk exposures and know where in the business process controls can potentially fail. 
Understanding where the critical breakpoints occur in business processes and having a 
manageable set of quantitative, forward-looking metrics for each process breakpoint are 
critical capabilities. For risks that are difficult to quantify (such as internal conduct or fair and 
responsible banking), banks can develop qualitative risk markers. Trends in staffing levels or 
changes in business processes and technology often correlate with increased risk. Even if 
quantitative metrics that directly measure residual risk cannot be defined, qualitative tracking 
of these trends can alert the institution about potentially increased exposure. With AML 
compliance, for example, some exposures can be measured through quantitative key risk 
indicators, while others will require qualitative risk markers (Exhibit 3). 



Exhibit 3 


The effectiveness of anti-money-laundering controls can 
be measured by quantitative key risk indicators or qualitative 
risk markers. 


EH KRI example U Risk marker 


Requirements Key risk indicators (KRIs) 
or risk markers 


Residual Test questions 
risk 


Customer 

risk 

assessment 


Report 

filing 


Customer 

identification 

program 


(CIP) 


Employee 

incentives 


New customers not risk-rated 
appropriately or in a timely 
manner 

High-risk customers not reviewed 
appropriately or in timely manner 

Medium 

Customer due- 
diligence requirements 
obtained and risk 
appropriately rated? 

If high risk, was 
customer added 

Customer-transaction reports (CTRs) 

Monetary-instrument logs 

Suspicious-activity reports (SARs) 

High 

to high-risk log? 

Was assessment of 
money-laundering risk 
completed in time? 

New customers not provided 
with CIP notice at or before 
account opening 

Low 


New accounts with inadequate 
verification of identity 



Existing customers without 
timely, complete, or correct 
due-diligence review 



Reporting forms (SARs, CTRs, 

CTR exemptions) completed 
by the same employee who 
made the decision to file the 
reports or grant the exemptions 

Medium 

Risk marker indicates 
misaligned incentives 
due to lack of segre¬ 
gation of duties 

Volume of CTRs in relation to 
volume of exemptions (did addi¬ 
tional exemptions significantly 
reduce CTR filings?) 

Growth in higher-risk operations 1 
without proportional increase in 

CTRs and SARs 


Risk marker indicates 
operations are 
outgrowing capabilities 
of compliance program 
(training, onboarding, 
monitoring) 


Higher-risk-customer examples: foreign financial institutions, deposit brokers, cash-intensive 
businesses, nongovernment organizations. Higher-risk-product examples: ATMs, private banking, 
foreign-correspondent accounts, trade finance, foreign exchange. 







5. Actively manage controls and 
management-information systems 


The portfolio of controls needs to be actively managed over the life cycle of each control. Old 
controls, testing strategies, and management-information systems (MIS) should be 
discontinued quickly when no longer needed or when deemed ineffective. Clearing away 
unneeded controls saves compliance and business resources and helps ensure that material 
risks are not missed. Many controls are redundant or obsolete—such as reports for a 
particular issue that no longer exists. Others have been added to old processes where 
underlying problems have not been remediated. The result is layers of detective controls but 
few preventative controls. For many activities, controls are overabundant and it is unclear 
which are the key controls that truly make a difference. A bank can have hundreds of mostly 
weak controls in its trading chains without understanding that 20 are the most important (and 
should be perfected and tightly monitored to mitigate risk). Finally, controls are often 
ineffective because they are insufficiently understood and consequently undermanaged (for 
example, supervisors may not understand their roles and control responsibilities). 

Markets businesses are a particularly challenging area for managing controls. These involve 
many frontline and middle- and back-office units, as well as risk and finance. We have 
encountered situations where more than 500 controls are in place, from supervisory controls 
in the front office to extensive reconciliation and reporting controls. A source of the challenge 
is the separation between units where risks emerge and those in charge of the controls. For 
example, frontline conduct risk may arise from ill-defined trader mandates or trade and 
booking data structures, while control responsibility rests with middle- and back-office units. 
These units, like compliance or control and settlement, might react by adding layers of control 
without identifying and addressing root causes upstream. 

By rationalizing the control portfolio, most banks will be able to reduce monitoring and testing 
activities significantly. The remaining controls should then be automated, where this is 
possible (such as system checks or work flow). In-line quality controls, such as document- 
quality tailgates, can replace manual checkers for controls that cannot be fully automated. 




For example, according to a legacy requirement of a consumer business unit at one bank, 
post-underwriting quality control of all new loan applications was performed by both an 
internal quality-control team and external attorneys. This triple-checking was replaced by 
quality tailgates much earlier in the process and automated data pulls that prevented errors. 
That eliminated most of the rework and expensive back-and-forth communications by 
attorneys, production, and the quality-control team. 

6. Optimize testing and monitoring 
activities. 

Duplication and overlap should also be eliminated from testing and risk-assessment 
programs, including BSA/AML, operational risk, IT risk, and first-line-of-defense activities. 
Furthermore, monitoring and testing standards need to be aligned with compliance standards 
in the first line of defense. These should be clearly tied to the inventory of material risks, 
associated key risk indicators, risk markers, and MIS. These measures will provide a clear line 
of sight to the risks the organization should focus on, what is being measured, and how the 
information will be used to make management decisions and prioritize resources. 

Having eliminated overlap, banks can streamline the remaining testing and monitoring 
activities. For rules-based compliance, subjective assessments can be replaced with 
objective measures of residual risk—actual defect rates for critical regulations. Meanwhile, 
manual testing methods should, where possible, be replaced with system-driven exception 
reporting, such as timeliness and accuracy of customer disclosures based on time stamps 
and figures in the system of record. Advanced analytics can be deployed to analyze financial, 
operational, and control performance and identify patterns and hot spots. This level of 
automation of manual tasks can provide an early warning of failing controls, obviating 
headaches down the road. For monitoring and testing activities requiring manual intervention, 
a testing utility can be created to standardize tests and improve load balancing. This will help 
ensure that capacity is utilized efficiently and according to target quality standards. 


7. Effectively manage supervisory and 
audit issues. 



At many banks, remediation of supervisory and audit issues accounts for a large part of the 
compliance budget and the related change-the-bank budget. In most cases, banks handle 
supervisory and audit issues individually. Each major finding results in a separate project, and 
little thought is given to related control issues and root causes. In our experience, the 
attendant costs of this approach can be significantly reduced by moving to a more integrated 
portfolio-management approach. 

Projects need to be managed on two dimensions: the underlying issues and the affected 
business areas. Supervisory issues related to client onboarding in the commercial-banking 
business unit, for example, need to be consolidated to avoid duplicating enhancements of 
core business processes. Effective KYC management for global banks in fact requires a 
centralized, cross-division view of customers and their business activities. Without this view, 
suspect activities could escape detection, or inconsistent client onboarding approaches and 
decisions may result. To address related BSA/AML issues, furthermore, banks will likely 
require a comprehensive and integrated approach to control design, to avoid uncoordinated 
technology efforts. 

Supervisors rightly value an adequate focus on the root causes of issues. Banks that have this 
focus are able to design changes to core business processes that stop issues from arising in 
the first place. When issues are addressed individually, the solution is often to put in place 
additional layers of manual controls. Root-cause analysis helps an institution become more 
resilient in its business environment while reducing reliance on costly manual controls. 

Where manual controls are still required to plug an existing gap, banks need to develop plans 
to automate them and/or redesign the underlying business process. Appropriate cost-benefit 
analysis should accompany such plans and help prioritize automation projects across the 
portfolio of remediation activities. Many banks would also benefit from comprehensive 
management reporting to measure the cost and effectiveness of remediation activities and 
make the best possible use of subject-matter experts and technology budgets to “buy down” 
the risks. 

Effective remediation governance—with clear responsibilities and effective implementation 
monitoring—can also reduce complexity and lower costs. This means clearly delineating 
responsibilities for all remediation activities among the compliance function, business lines, 
and other control functions. 



The cost of regulatory compliance in financial services has spiked over the past decade. In 
particular, resources in the first and second lines of defense have expanded dramatically. As a 
result, the industry has become more resilient and the quality of risk management has 
improved. The current resource-intensive approach to managing compliance is not, however, 
sustainable in the long run. While the demand for compliance activities is largely out of banks’ 
control, these seven practical steps can optimize how banks respond to that demand and 
allow meaningful progress toward a sustainable compliance function over time. 



Taking the stress out of operational- 
risk stress testing 


Financial institutions are facing heightened supervisory scrutiny, but those 
that establish a structured and calibrated approach to operational-risk 
stress testing will thrive. 


T he past few years have seen the emergence of a new normal in the discipline of 

operational risk, especially in the financial-services sector. Financial institutions have 
experienced an increased number of significant incidents with major financial implications. 
These have ranged from cybersecurity breaches to rogue-trading events to problems in sales 
to large supervisory penalties and class-action lawsuits. 

These events have led to heightened supervisory scrutiny of both measurement and 
management practices in operational risk. In the United States, supervisors have raised the 
bar for strong operational-risk-management practices and have mandated bank holding 
companies (BHCs) to perform comprehensive operational-risk stress testing as part of the 
overall comprehensive capital analysis and review (CCAR) process. Projections of losses 
arising from inadequate or failed internal processes, people, and systems or from external 
events must be reported by the BHC as operational-risk losses, a component of pre¬ 
provision net revenues. 

This paper focuses on the measurement of operational risk, specifically for stress-testing 
purposes. With practices in operational-risk stress testing still evolving, banks are faced with 
a range of questions on methodological choices and the corresponding trade-offs. These 



questions primarily are centered on the challenge in correlating operational-risk losses with 
macroeconomic factors and business environment and external control factors; the handling 
of large historical losses in internal loss data sets; stressing historical, current, and future legal 
losses; and incorporating large plausible events that might occur during the nine-quarter 
forecast period for stress-testing purposes. 

Hence, it is important for BHCs to establish a structured and calibrated approach to 
operational-risk stress testing. Establishing such an approach will help them avoid 
supervisory objections (matters requiring immediate attention and matters requiring 
attention) by suitably addressing rising regulatory expectations. It will also benefit the 
institution through the establishment of strong foundational risk and business practices, for 
example, loss-data capture and loss-reduction actions, scenario analysis and risks/controls 
assessments and corresponding risk-mitigation actions, and getting a dynamic 
understanding of the true risk profile, including sensitivities of losses and capital to key 
events and drivers. 

Key challenges in operational-risk stress 
testing 


BHCs have been facing a common set of challenges in operational-risk stress testing over 
the past two to three CCAR cycles. These challenges have occurred in the same areas where 
a majority of the supervisory objections have been focused: 

1. Ensuring sufficiency and quality of data being used for modeling. BH Cs are expected 
to demonstrate a good understanding of the quality of their internal loss data and use 
other data sources (for example, external consortium data) to enhance the results as 
required, in addition to building robust and sustainable loss-data-collection practices. 
Operational-risk loss-data quality has been a long-standing challenge for banks given 
the wide-ranging sources of these data (beyond the financial systems of the bank) and 
the dispersed set of stakeholders involved in the data-collection process. Other drivers 
include a perception that operational-risk loss-data collection and reporting is not 
mandatory and an aversion to reporting bad news. 



2. Correlating operational-risk losses with macroeconomic factors. While it is well 
understood that operational-risk losses may not always be correlated with 
macroeconomic factors, BHCs are nevertheless expected to attempt to model 
operational-risk losses for stress scenarios to the extent that they are able to, and 
justify the results from a sound statistical standpoint as well as on the basis of business 
intuition. 

3. Estimating legal losses under stress conditions. Legal losses form a large chunk of a 
BHC’s total operational-risk losses. Hence, it is important to be able to estimate the 
impact of legal losses—historical, pending, and future—under stressed conditions. The 
process for stressing legal losses is still evolving from both a methodological 
standpoint and a process standpoint (for example, deciding which stakeholders should 
be involved in the process given the privileged nature of the information). 

4. Estimating the impact of the future unknowns using scenario analysis. While modeling 
of the stressed operational-risk losses using historical loss data provides some 
estimate of future losses, BHCs also need to have a robust scenario-analysis process 
and choose the appropriate number and types of scenarios in order to estimate the 
impact from large unknown events that might occur during the nine-quarter CCAR 
forecast period. While many banks now have a scenario-analysis process in place, their 
programs often need to be strengthened with regard to use of the right information 
sources, involvement of senior business leaders, and effective challenge and bias 
control in workshops. 

5. Aggregating total stressed losses across the components and ensuring strong review 
and challenge of the results. Once the BHC has estimated the baseline losses and the 
different components of stressed losses, it needs to have a sound methodology to 
aggregate the results and adequately review and challenge them, using appropriate 
data and tools. 


A structured and calibrated approach to 
address these challenges 



BHCs have in the past used a range of approaches for operational-risk stress testing for 
CCAR. These include, among others, regression models, loss-distribution-approach (LDA) 
models, historical averages, and scenario analysis. However, our experience has shown that 
on its own, any one of these approaches is not sufficient to address the challenges described 
earlier. Our view is that BHCs need to have a hybrid approach that combines the power of 
these individual approaches to build up to the total stressed losses for operational risk in a 
stepwise manner. The exhibit illustrates the stepwise approach, which is described in greater 
detail in the remainder of this section. (The relative sizes of the four blocks that are shown are 
purely illustrative; the actual contributions of each block vary from one bank to another.) 



Exhibit 


A hybrid approach is used to calculate operational-risk estimates. 
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operational-risk losses, $ 
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expected outcome of current 
and pending operational-loss 
events (eg, legal reserves) 

Q Modeled 
stressed 
losses 

Estimate expected 
operational losses in 
stressed conditions, based 
on correlations with 
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Q Legal 
stressed 
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Quantify stressed legal 
losses and expenses due 
to current/pending litigation 
by estimating impact of 
unfavorable rulings or 
settlements 

Q Scenario 
analysis 

Assess the severities of 
plausible future large loss 
events across a carefully 
chosen set of scenarios 
relevant for the institution 


Calculating baseline losses 

To quantify baseline operational losses reliably, the BHC needs to consider the following 
elements: 








1. The BHC must ensure robust quality of the available historical data. It must also have 
strong visibility into potential gaps and consider suitable steps to address these gaps, 
both in the near term for stress-testing purposes and in the longer term to improve the 
quality of loss data being collected. Such assessments usually include a thorough 
review of the loss-data-collection process, including the ownership of the first line of 
defense, reconciliation with other internal sources, and the governance and oversight 
of the end-to-end process. Comparing the profile of internal loss data with external 
(consortium or vended) data that are appropriately filtered to include comparable peers 
is also useful in assessing the overall profile of internal loss data. 

2. Once the quality and sufficiency of the internal loss data has been established, the 
baseline losses should be calculated based on historical average realized losses, taking 
into account the expected outcome of current or pending operational-loss events, 
including legal-loss provisions. 

3. The BHC should place a very high bar on justifying any potential exclusions of either 
large loss events or losses arising from discontinued businesses or products or from 
divestitures. 

4. The BHC should also take into account the strategic plan and associated budgets and 
adjust the baseline to reflect changes in business strategy. 


Modeling stressed losses based on 
historical loss data 

While it is well understood that operational-risk losses may not always be highly correlated 
with macroeconomic factors, BHCs are expected to examine the relationships that might 
exist in their internal loss data sets. 

A robust approach to examining these relationships is to estimate correlations between 
macroeconomic factors (for example, the ten-year US Treasury rate, unemployment rate, 
house-price index, and credit-card delinquency) and historical loss frequency and loss 
severity, respectively. 



BHCs should not try to force the use of unstable or unobservable correlations. They should 
also be able to justify the correlations using strong business intuition and reasoning. If the 
BHC has limited loss history that limits its ability to model macroeconomic correlations using 
internal loss data, it can consider the use of suitably filtered external loss data—for example, 
data from the American Bankers Association or the Operational Riskdata exchange 
Association—to compute the correlations. Also, defining units of measure (UOMs) that are 
more homogeneous than just the Basel event categories and modeling the losses around 
these UOMs may help in finding stronger statistical relationships between operational-risk 
losses and macroeconomic factors. For UOMs that do not show relationships with 
macroeconomic variables, the use of nonparametric modeling approaches can be 
considered. Statistical tests, for instance, the Kruskal-Wallis test or analysis of variance 
(ANOVA), can be employed to understand if the frequency and severity are different between 
stress and nonstress periods, and a stress-multiplier approach can be applied to the baseline 
to compute stressed losses. BHCs can also try to find correlations between losses and 
business environment and external control factors (for example, risk and control self- 
assessment scores or key-risk-indicator values) based on the assumption that these would 
be affected during the course of macroeconomic stress. 

Despite all their efforts, BHCs might still fail to establish a clear relationship between 
macroeconomic variables and operational losses. This potential outcome is especially likely 
for efforts to stress severities and is driven by the very nature of operational-risk losses. 

Quantifying stressed legal losses 

Legal losses form a large part of overall operational-risk losses. Hence, there is considerable 
regulatory scrutiny of the capture and use of litigation-related information for stress-testing 
purposes. 

Broadly speaking, there are three components of stressing legal losses, each of which should 
be considered separately: 

1. Stressing historical legal losses. Legal losses contained in the historical internal loss 
data set are stressed as a part of the correlation analysis. The historical legal-loss data 
should be included in the overall internal loss data set being used to estimate 
correlations between macroeconomic factors and operational-risk losses. 



2. Stressing current, pending, and threatened litigation. The recommended methodology 
follows these steps: use a robust process for estimating the impact of unfavorable, 
stressed outcomes on known current, pending, and threatened legal claims; apply 
sound judgment, taking into account the reasonably possible adverse outcomes based 
on the specific merits of the cases in question and of similar past cases; apply a 
suitable estimate of legal fees and expenses, supported by past data and an up-to- 
date fact base. 

3. Stressing potential litigation-related losses. This involves estimating losses from 
potential litigation actions that are not known at this time and is captured through the 
scenario-analysis process. If the specific scenarios chosen for the workshops have a 
litigation component, estimating the severity of this component using the scenario- 
analysis process will provide visibility into potential future litigation-related losses. 

Enhancing stressed-loss results using 
scenario analysis 

Modeling stressed losses based on historical loss data sets has the inherent limitation of not 
being able to get at the unknown events that might not yet have materialized but are plausible 
in the future, based on the risk profile of the bank. In fact, such “tail” loss events, if they 
happen during the nine-quarter CCAR forecast period, are often likely to make up the bulk of 
the stressed losses. Hence, BHCs are typically expected to have a structured, transparent, 
well-supported, and repeatable scenario-analysis process that is subject to independent 
review and validation. 

BHCs need to use multiple data and information sources along with strong business inputs to 
generate a list of potential scenarios that reflect the operational-risk profile of the institution. 
These inputs can include external sources of industry-standard scenarios. A set of key criteria 
that can be used to select specific scenarios for discussion in the workshops is described 
below: 


• Plausible. Is the scenario relevant to the risk profile of the BHC? Is the scenario 
realistic? 




Forward looking. Does the scenario incorporate anticipated trends and emerging risks? 



• High severity. Is there large direct financial impact associated with the anticipated loss 
event, not including opportunity costs? 

• Low likelihood. What is the likelihood that the anticipated loss event might occur over a 
defined time frame, say, once in x years (where x might, for example, be determined by 
reference to a once-in-a-career type concept or by reference to the implied likelihoods 
of adverse and severely adverse outcomes as defined by the Fed scenarios)? 

To quantify these scenarios in a workshop setting, the BHC needs to ensure the following: 

1. strong business representation in the workshops, along with functional and subject- 
matter experts 

2. well-researched and succinctly written preread material that the participants can use 
prior to the workshops, to get smart on the scenario in order to effectively engage in 
the discussion 

3. strong facilitation by trained facilitators to ensure adequate challenge and bias control 

4. bias-controlled ways of quantifying the scenarios, for example, the use of anonymous 
voting 

The process and the outcomes of these scenarios should be documented in a well-structured 
scenario library to ensure transparency and facilitate strong independent review and 
validation. 

Aggregation of the total operational-risk 
stressed losses and review and challenge 
of the results 


Once each of the four components described in the exhibit have been quantified, the BHC 
needs to aggregate these components to calculate the total operational-risk losses for 
stressed conditions. The simplest approach is to add the severities across each of the four 
steps to produce the overall stressed-loss estimates. That said, there are certain 
considerations that the BHC should take into account while aggregating the stressed-loss 
numbers: 



• If there are one or more large (tail) loss events in the historical internal loss data set that 
is being modeled, the regression models might lead to significant amplification of these 
losses. In such cases, the BHC needs to be careful while selecting and quantifying 
scenarios that might capture similar loss events in order to avoid substantial double 
counting. 

• If the BHC believes that through its scenario-analysis program it needs to quantify a 
relatively broader set of scenarios in order to reflect the true loss profile of the 
institution, it will be faced with deciding how many of these scenarios to include in the 
stressed-loss-estimation process. This decision is particularly important since a 
relatively larger number of low-likelihood scenarios are unlikely to happen at the same 
time during the same nine-quarter forecast period and might lead to artificially high 
stressed-loss numbers for the BHC (effectively quantifying losses greater than the 
implied likelihoods of the Fed’s adverse and severely adverse scenarios). 

Finally, once the overall process for estimating operational-risk stressed losses has been 
executed and documented, the results must be adequately reviewed and challenged by 
suitable governance forums and committees. In order to facilitate this review and challenge, a 
range of benchmarking data and tools can and should be presented to the review and 
challenge committees. These include benchmarks based on historical internal and external 
loss data, for example, average nine-quarter losses from the internal loss data set, the most 
recent nine-quarter losses, and the worst nine-quarter losses. If the BHC has a robust LDA 
model, it may want to compare the severities predicted by the LDA model (for a range of 
percentile cutoffs, for example, 85th, 90th, and 95th percentiles) with the stressed-loss 
results derived from the approach described in the previous sections. 


In our view, it is important for financial institutions to invest early to build the foundational 
capabilities of strong operational-risk stress testing, which can then transition into a 
business-as-usual activity for the institution. This involves creating and executing on a plan to 
strengthen the quality of internal loss data being collected, robust capture of operational-risk 
events and near misses, rolling out a robust scenario-analysis program with strong business 
involvement, and ensuring strong ongoing involvement of key stakeholders (for example, legal 
and compliance) in the program. 




These efforts will have direct business benefits in the following ways: 


• getting a better understanding of the overall operational-risk profile of the bank, 
including sensitivities to key events and macro factors 

• providing greater visibility into operational-risk losses and loss events, thereby driving 
efforts to reduce losses 

• helping the institution get a handle on unknown risks and the safeguards and controls 
that may need to be established or strengthened 

• driving operational-risk appetite and capital-allocation decisions based on the stress- 
test results 


In addition to the benefits described above, this approach will also ensure that the BHC can 
avoid supervisory objections in an environment where the bar is constantly rising—and 
thereby take the stress out of its operational-risk stress-testing activities. 



A marathon, not a sprint: Capturing 
value from BCBS 239 and beyond 


Meeting more stringent regulations requires banks globally to spend 
billions of dollars. Yet with the right long-term strategy, they could realize 
even bigger annual savings. 


S tringent banking regulation has become even more the norm for the financial- 

services sector across the globe. Global systemically important banks (G-SIBs) and 
domestic systemically important banks (D-SIBs) have been given extra layers of 
requirements. 

In January 2013, the Basel Committee on Banking Supervision issued 11 principles for 
effective risk data aggregation and risk reporting (BCBS 239) and outlined the paths to 
compliance for G-SIBs and D-SIBs. The BCBS 239 requirements are intended to address 
what supervisors see as a major weakness that banks carried into the crisis: inability to 
understand quickly and accurately (and tell their supervisors about) their overall exposures 
and other key risk metrics influencing the key risk decisions of the bank. The regulation was, 
however, designed at a high level, using a principles-based approach that allowed banks to 
interpret and build tailored remediation approaches. While this can be perceived as a burden, 
it can also be seen as a great benefit. Banks have the opportunity to interpret this regulation 
using a strategic lens that allows them to balance the right decisions to gain a competitive 
advantage, which would be lost if the work were driven from a “checking-the-box” technical 
perspective. 



Aligning with the 11 principles is a lengthy and complex process. It requires interweaving risk 
data aggregation capabilities with supervisory risk-reporting practices (running on a sound 
technical infrastructure). It also needs support from the right level of governance to ensure 
that information flows in the right ways, along with sustained commitment by the organization. 

Beyond BCBS 239, a further host of critically important regulatory items will have 
implications for risk and finance data and technology in banks: 

• In the United States, comprehensive capital analysis and review (CCAR) and 
comprehensive liquidity analysis and review (CLAR) 

• In the European Union, comprehensive assessment, asset quality review (AQR), stress 
testing, analytical credit, and supervisory review and evaluation process (SREP) 

• Globally, evolving requirements for the Financial Stability Board (FSB) data templates, 
revised and expanded Pillar 3 disclosures, and intersecting with the recommendations 
of the private-sector but FSB-inspired Enhanced Disclosure Task Force 

In addition, significant accounting changes such as IFRS 9 and the parallel US Current 
Expected Credit Loss (CECL) proposal for loan-loss provisioning will make additional 
demands. These changes will further strain bank management, requiring additional large 
investments and additional enhancements to the data infrastructure. 

We foresee two large consequences if data and IT platforms for these programs are not 
properly addressed. First, there is massive regulatory risk and a reputational risk if a bank fails 
to comply. Aside from possible specific supervisory measures against banks that don’t get it 
right, deficiencies reported in early assessments of BCBS 239 often figure in “break-up-the- 
banks” arguments. Second, the bank might incur excessive but not fully productive 
investment and put strains on management capacity. Risk and finance data and technology 
should become—and already have become in many institutions—key strategic board-level 
topics. Most institutions agree with the view that BCBS 239 compliance is not the end, but 
rather the beginning of a continuous journey of enhancing Risk and Finance data aggregation 
and reporting. Many regard this process as a long-term cultural transformation that will 
change how banks look at and work with their data and technology to generate risk and 
opportunity insights. 



This perspective is reflected in the numbers. Based on our joint 11F / McKinsey industry 
survey, we estimate that the overall banking industry is spending a total incremental 
investment between USD 12 billion and USD 15 billion on Risk and Finance Data and 
Technology transformation (Average G-SIB: USD 230 million, average D-SIB: USD 75 million). 
Much of this investment is already underway (mainly in G-SIBs, with the bulk starting around 
2013) and will continue for the next 3-5 years (mostly by recently designated D-SIBs). These 
are certainly very significant figures, warranting utmost care and strategic foresight to steer 
investments in a value-based way. Indeed, some banks are looking beyond the direct 
regulatory demands and complexity, considering how to leverage their investments and drive 
strategic opportunities, rather than just improving reporting capabilities. In short, they are 
focusing on uncovering what could drive the most value for the investment. 

The good news is that in survey respondents’ views, as well as ours, there is indeed a great 
deal of value to unearth. Based on projects and case studies, McKinsey estimates that with 
strategically targeted and run Risk and Finance Data and Technology programs, the industry 
as a whole could add between USD 19 billion and USD 24 billion of annual benefits to the 
other side of the equation, including revenue improvement, capital enhancement and 
Operations and IT expense reduction. We will discuss these estimates in greater detail later in 
the paper, but it is important to note that these projections depend significantly on starting 
position and on the scope and aggressiveness of the data transformation. Reaping the full 
benefits as project would depend for most banks on significant investment in business¬ 
enabling analytics (with a typical budget of USD 100-150 million). 

Irrespective of the specific figures, the general message is compatible with the view of most 
industry participants (expressed both in the survey and in recent live polls at McKinsey 
roundtables) that BCBS 239 acts as a catalyst for meaningful investments that would have 
been the right thing to do anyway. Despite the promise of this undertaking, however, it is 
important to remember how difficult and complex it is likely to be: very high investments, 
many complex interdependencies, overlaying timelines and scopes, multi-jurisdiction, and 
(despite the global standard set in BCBS 239) possibly unaligned regulations and 
supervisors’ requirements. 

To support the industry through this complex journey, McKinsey & Company has partnered 
with the Institute of International Finance (IIF) to conduct initial research and annual 
benchmarks, working-group discussions, and roundtables with banks and regulators. The 
goal has been to understand the approaches that G-SIBs and D-SIBs are taking to embrace 



the BCBS 239 principles and to go beyond them, to give banks a sense of what their peers 
are doing, and to distill the key strategic issues that need remediation for banks to be on track 
for compliance and seizing strategic value beyond that. This report sheds light on industry 
preparedness and the remaining challenges. More importantly it looks at solutions for 
achieving compliance and possibilities for gaining new competitive advantages. 



The impact of regulation 


The chief financial and risk officer of APG, Angelien Kemna, believes 
pension funds and regulators must work together to foster opportunities 
for long-term investment while ensuring stable, sound, and safe financial 
markets. 


P ension funds can play an important role in fostering long-term investment and 

economic growth. While banks continue to withdraw liquidity from the capital markets 
by making fewer loans, pension funds and their asset managers are well suited to fill that 
funding gap. Because our mandate is to fund the retirements of workers who may not be 
leaving the workforce for decades, we are able and willing to make very long-term 
investments. A long time horizon fits both the large scale and global nature of our operations 
and our fiduciary responsibility. More important, maintaining a long-term perspective benefits 
our pensioners, in whose interest we act. For these reasons, we strongly support the current 
global efforts to stimulate long-term investment. 

It is, however, not only a matter of ability and willingness. We need to create the right 
incentives and at the same time remove barriers that constrain long-term investment. 
Unfortunately, regulation often forms one of those barriers. Obviously, regulation is vitally 
important: it serves as a traffic officer in the crowded streets of the financial markets. When 
drafted and applied correctly, it can be an effective tool for creating financial stability and 
restoring and maintaining confidence in the financial markets. When it functions to enable 
long-term investment, it can pave the way for citizens to meet their future financial needs. 



But when regulations have the unintended effect of discouraging or even prohibiting long¬ 
term investment, they need to be identified and eliminated. Over the past few years, an 
enormous number of new rules have been created in reaction to the global financial crisis. In 
many cases, these rules have been too wide ranging. Failure to appropriately tailor 
regulations can close off opportunities to make long-term investments that could be widely 
beneficial. For example, new margin requirements for derivatives are meant to reduce 
systemic risk. Pension funds are highly creditworthy institutions that pose little or no such 
systemic risk to the financial markets. Forcing them to set aside assets for collateral purposes 
in the same manner as a bank or hedge fund does not make sense, and it results in a direct 
loss of long-term-investment opportunity. 

Categorizing the impact of regulation on 
long-term investment 

The impact of regulation on long-term investment is a complex matter. This is not only due to 
the fact that such investments involve a variety of products, market players, and jurisdictions. 

It is also because the inhibiting effect of regulation is often difficult to see and to quantify. To 
address this issue, we tend to distinguish different categories of regulatory impact on long¬ 
term investment in our discussions with regulators and supervisors. 

The rules that encourage long-term investing (positive impact) are to be separated from those 
that discourage it (negative impact). Both forms of impact can either be direct or indirect. We 
classify rules that apply to actual long-term-investment products or strategies as having a 
direct impact. Rules that apply to other levels, such as investors, or to other products or parts 
of the market can also impact the ability or willingness to engage in long-term investment. We 
call this the indirect impact of regulation. That results in four categories of impact: direct and 
indirect positive impact and direct and indirect negative impact. 

The problem is not only with the regulations that exist but also with the regulations that do not 
exist. In circumstances where regulation could have a positive impact on long-term 
investment but is lacking, it needs to be created. This goes for both the direct and indirect 
forms of positive impact. For example, standardization of regulations relating to covered and 
green bonds and cross-border investment through real-estate investment trusts would 
encourage more long-term investment. In a more indirect way, a general regulatory push for 



increased availability of long-term-investment projects and harmonizing of local insolvency 
regimes would also have a positive effect. We elaborate on these examples below. Failure to 
fill existing regulatory gaps will ultimately depress long-term investment. 

Prominent examples of direct negative impact include proposed securitization regulations 
and rules on asset-based capital charges. These regulatory initiatives have the opposite 
effect of what we need: they hamper long-term investment. Indirect negative impact is more 
hidden in nature and thus less visible. Nonetheless, it can be just as important as direct 
negative impact. This is particularly true if the rules result in investors having fewer funds 
available for long-term investment. Margin requirements for derivatives transactions and the 
increase in banking costs that are passed on are crucial examples of indirect negative impact 
of regulation. 

Negative indirect impact of regulation has taken a back seat in long-term-investment 
discussions. A report issued by the Financial Stability Board (FSB) in September 2014 on 
relevant regulatory long-term-investment factors confirms this view. In its report, the FSB 
concludes that empirical evidence suggesting that regulatory reforms have had material 
adverse effects on the provision of long-term financing is lacking. In its continued search for 
data, the FSB then formulates a set of key indicators that could be taken into account. These 
indicators focus on existing capital flows and sources of funds. But this is only part of the 
picture. The funds not invested need to be mapped as well. If not, the indirect negative effects 
of regulation on long-term investment could become the assassin of long-term-investment 
growth. 

First steps for regulations that encourage 
and support long-term investment 

Understanding the four kinds of impact can help bring about rules that safeguard markets 
while maximizing the opportunity for long-term investment. We offer specific examples for 
each category below. Although these examples are not exhaustive, we believe they offer 
good starting points for taking action toward regulatory improvement. In addition, they may 
help inform thinking in general on the different ways regulation can encourage or inhibit long¬ 
term investment. 



1. Direct positive impact: Standardize 
rules across jurisdictions 


Standardizing the rules regarding covered and green bonds would be a straightforward way 
of creating direct positive impact. Currently, covered bonds, which are backed by a dedicated 
pool of assets, are subject to regional and even bank-specific rules. Regulators and investors 
should work together to create a global level playing field. In particular, standards should be 
formulated for overcollateralization, haircuts, valuation, the legal position of bondholders, and 
the treatment of residual debt. In addition, regulators and the industry should work to create 
common accounting standards for bondholders, as well as clear collateral requirements. 
Standards should include a requirement that covered bonds be rated by at least two rating 
agencies. Similarly, green bonds, which could be a powerful force for mobilizing capital for 
projects with environmental benefits, must be supported with effective regulation that 
mitigates the risk of greenwashing, or the unjustified appropriation of environmental virtue. 
Failure to formulate effective regulations will dampen the growth of this potentially beneficial 
market. 

Real estate, too, should be an important asset class for long-term investors. To that end, we 
would welcome the introduction of EU-based real-estate investment trusts, which could be 
used to facilitate cross-border real-estate investments, but again, they must be supported 
with effective and standardized rules. 

2. Indirect positive impact: Tailor the 
rules to the investor 

One barrier to long-term investment is a shortage of long-term-investment projects. Even 
taking market-generated and government projects together, there are simply not enough 
opportunities. There should be a broad assessment of how to stimulate the demand side of 
long-term investment through supporting regulation. Part of that assessment should take into 
account risk-return profiles and other relevant investment criteria for large institutional 
investors. The World Economic Forum’s Infrastructure Investment Policy Blueprint could 
provide pointers. As we have publicly stated, to facilitate investing for pension funds and 
other large investors, governments must ensure clear and stable regulations. This should 



include eliminating fossil-fuel subsidies, higher prices for C02 emission rights, and increased 
support for research into cleaner energy, to make investments more attractive to pension 
funds and allow them to meet their sustainability goals. 

Discrepancies in local insolvency laws form a powerful indirect impediment to long-term, 
cross-border financing, especially within the European Union. These discrepancies create 
uncertainty and, therefore, risk in credit-financing transactions. They can also lead to 
excessive price fluctuation, especially in the case of default. 

3. Direct negative impact: Distinguish 
among levels of risk in similar 
investments and investors 

The (proposed) regulatory framework for securitization transactions has had a direct negative 
impact on investment behavior. Solvency II and Basel III proposals and resulting uncertainty 
about capital charges and liquidity treatment for securitizations have reduced investors’ 
appetite to invest in this asset class. Securitized assets are an appropriate investment for 
pension plans, assuming they are properly structured and of good quality. They allow pension 
plans to contribute to the financing of real economy assets such as residential houses, 
consumer-loan leases, and loans to small and medium enterprises. There seems to be 
recognition today that the securitization markets need to be revived. In resetting the 
regulatory framework, however, special care must be taken to avoid unintended 
consequences. Rule makers must acknowledge that not all securitizations carry the same 
level of risk and make efforts to avoid unduly burdensome regulations. 

Another area of direct negative impact concerns asset-based capital charges. Capital 
requirements for specific asset classes imposed by Solvency II will limit the amount of capital 
available for long-term investment. Here again, regulatory measures should take into account 
the varying risk profiles of different types of investors. 



4. Indirect negative impact: Avoid rules 
that unintentionally divert cash from 
long-term investment 

There are numerous examples here. Current regulation of over-the-counter derivatives has, 
for instance, an indirect negative effect on the ability to contribute to long-term investment, 
as the rules reduce available funds. Measures like the European Market Infrastructure 
Regulation result in increased allocation to high-quality government bonds and cash for 
collateral purposes. Since returns on government bonds are and will continue to stay low, 
such measures force a deviation from an optimal investment mix. Derivative collateral 
requirements, whether imposed by regulation or by central clearing houses, can have a pro¬ 
cyclical effect in distressed markets by forcing fire sales of assets. Scarcity of eligible 
collateral will then have serious liquidity—and thus long-term-investment—consequences. 

The increased banking costs that result from new regulatory measures are another source of 
indirect negative impact. Those costs are passed along to clients, including pension funds, 
once again reducing the amount available for long-term investment and forcing pension 
funds and other clients to pay the price for a crisis they did not cause. The net stable funding 
ratio, created by the Basel Committee on Banking Supervision, could prove to be yet another 
source of negative impact, since the rules would make it much more expensive to provide for 
certain equity products that are frequently used by pension funds. 

In the global debate on ways to enhance long-term investment, pension funds have correctly 
been identified as a potential source of nonbank funding. Executed correctly, regulation can 
stimulate our ability to engage in long-term investment. Done poorly, it can have the opposite 
effect. Care must be taken to avoid regulation that results in constraints on long-term 
investment in both direct and indirect ways. The serious problem of indirect negative impact, 
in particular, tends to be overlooked in this debate. 

In general, the unintended consequences of regulation must be avoided at all times. The total 
impact on long-term investment of all individual pieces of regulation—plus how these pieces 
add up and affect one another—must be understood. In addition, rules should be 
appropriately tailored for different market participants. Unnecessarily broad rules cause 
needless constraints and ultimately a loss of return for pensioners. 



For the long-term-investment debate to be effective, all forms of impact must be analyzed 
and carefully considered. This is not an easy job but one that must be undertaken to 
successfully encourage long-term investment. We are here for the long term, as are the 
global regulators and supervisors. It is our hope that with ajoint effort, we can make sure that 
regulatory initiatives create stable and sound financial markets without diminishing the 
opportunities for meaningful long-term investment. 



Ratings revisited: Textual analysis for 
better risk management 


Textual data—from analysts’ reports to blog posts—can help banks 
enhance their credit-risk models. 


M ost banks use credit-rating models to help them make decisions about lending to 
companies. Such models are indeed a requirement for banks using Basel M’s 
internal-ratings-based approach. But these models often have significant shortcomings. 

First, they are frequently backward-looking. Second, they rely on borrowers’ formal financial 
reporting, which means that data are always at least 6 months old; toward the end of the 
fiscal year, data are nearly 18 months old. Third, qualitative assessments of borrowers are 
often simplistic. And finally, many banks rely on their credit-rating models to provide both a 
current snapshot and a longer-term view, with the result that they do neither well. 

Textual information can help banks overcome some of these challenges and improve their 
credit-risk assessment, in particular their approach to qualitative assessment. This 
information includes professionally produced content such as analysts’ reports and business 
journalism, as well as informal texts such as blogs and posts on social networks. Compared 
with the financial information available about small and midsize enterprises (SMEs) or 
corporates, the amount of textual content about companies is immense and provides a wealth 
of information. News articles describe the latest developments of companies; analysts’ 
reports provide insightful analyses on companies’ strategies, competitive positioning, and 



outlook; product ratings on online-shopping sites provide unfiltered views of customer 
satisfaction; and microblogs such as Twitter distribute the latest news (and sometimes gossip) 
with unprecedented speed. 

Enormous quantities of textual information are available; this information offers companies a 
deep look at their health and performance, and it is notoriously difficult to use. But we have 
developed a prototype model that can identify and quantify sentiment within a trove of textual 
information, and it has performed extremely well in pinpointing default risks at a very early 
stage on a wide range of performance measures. We argue that if banks can put even a 
portion of this information to use in their systems, the accuracy, timeliness, and forward- 
looking character of their credit-risk-assessment systems would all be improved. And textual 
analysis can also help banks in other areas, improving their traditional analyses of industries 
and sectors. 


Challenges of textual data 


The challenges of mining this information and separating the signal from the noise are 
substantial. To use textual data, banks must first face a practical challenge: computational 
capacity. The amount of text-based information available is already enormous, and it’s getting 
bigger. Banks’ computers would strain to read and analyze it in daily operations or even to 
batch process it for model development. A database with news articles on about 1,000 
companies easily exceeds 20 GB, orders of magnitude more than a financial database on 
these companies. Storing this much data is not difficult, but any kind of statistical analysis 
becomes an “overnight job,” even with optimized algorithms and systems. 

Second, textual data are unstructured. While it is relatively easy to analyze financial data in a 
statistical way—figures become meaningful at a certain size and in relation to sample 
averages—texts are a priori meaningless to a computer. There are no standard or statistical 
procedures for a machine to analyze and interpret texts. 

Third, texts are often ambiguous. In particular, the meaning of short messages in social media 
is difficult to interpret—even for humans. While complicated sentence structures can be 
taught to computers, the concept of sarcasm or irony is extremely difficult. In fact, almost all 
the semantic difficulties of written language pose immense problems for machines. 



Sentiment analysis 

Companies in other sectors have already begun to employ a new technique, sentiment 
analysis, that banks can also use to get around these obstacles. The basic idea is simple and 
elegant: textual information in any form (words, sentences, paragraphs, articles, or books) is 
assigned a “sentiment index”—a number that represents a kind and degree of opinion 
expressed by the writer, such as optimism, trust, skepticism, mistrust, pessimism, and so on. 
Gauging sentiment with an index makes it possible for machines to analyze the information; it 
can be converted, aggregated, and compared. And the index can be used with statistical 
analysis to build prediction models. Obviously, the difficulties come in the details of assigning 
the sentiment index. 

At the core of the process is a lexicon that lists words or phrases that represent a certain kind 
of sentiment and, importantly, reflect the specific context in which the text appears. Phrases 
that a novel’s heroine might use to describe her pessimism might not be the same as those— 
such as “legal proceedings,” “owner disputes,” or “financing problems”—that indicate financial 
concerns about companies. The lexicon must be contextualized appropriately if it is to have 
the kind of accuracy banks need. 

Just as important as properly defining the lexicon is selecting and filtering data sources. A 
broad search will yield more potentially relevant articles to be analyzed, but it will also pull in 
much irrelevant material. That poses a problem when seeking information about companies 
with ambiguous or generic names. When stories about Berkshire Hathaway, the US 
multinational conglomerate, are wanted, stories about Anne Hathaway, the US film actress, 
are not, as one hedge fund found out to its cost. With smart search tags and additional text 
filters, these challenges can be overcome. 

Applications and benefits 

Sentiment analysis and the information it yields can improve banks’ credit-rating models, and 
it can also help with two other important tasks. 



In rating models, banks can use the sentiment index as an additional rating factor. Information 
gleaned from text searches is aggregated quarterly into a sentiment index for each company. 
After statistical analysis, the index is then integrated into the rating system at an appropriate 
weight. This can be particularly valuable in assessing new corporate customers for which 
banks typically have only limited information, most of it provided by the customer. A 
systematic screening of public information can reveal important additional insights. In 
emerging markets, where reliable customer data are scarce, the analysis of textual 
information can yield insights as well (exhibit). 

Exhibit 

Textual analysis has many applications in banks’ risk- 
management systems 


Example application 


Early-warning 
system for SMEs 1 


Remote or 
international 
customer 
monitoring 


Financial-market 

monitoring 


Industry-trend 

monitoring 


Additional risk 
factor in emerging 
markets 


• Conduct daily or weekly sentiment monitoring of SME customers 
(>€10 million turnover) 

• Integrate sentiment factor into early-warning system 

• Automatically screen remote international portfolios 

• Conduct benchmarking with own risk assessment of local 
credit officers 

• Screen news on banks and financial markets on a daily basis to 
identify sentiment shifts 

• Use in regions where credit-default-swap markets are not liquid 
and many counterparties are semipublic companies 

• Systematically analyze published expectations on industries/sub 

• Use sentiment index as input in portfolio models or economic- 
forecast models 

• Include sentiment index in rating models in emerging markets such 
as Indonesia 

• Compensate for data scarcity with public information 





Another use is in early-warning systems. Due to the timeliness of the information and the high 
level of automation that is possible, we foresee a great benefit in applying the sentiment index 
as an early indication of a company’s troubles, either by itself or integrated into an early- 
warning system with other financial, industry, and behavioral factors. In such a system, the 
sentiment analysis would automatically screen all relevant news articles. These articles could 
be filtered based on defined thresholds and presented to the relevant credit officers for 
further action. The system would be valuable for banks and for regulators, which might use it 
to monitor public sentiment about the banks under their jurisdiction. If regulators could detect 
shifts in sentiment that portend danger for a bank, they would be able to move early to 
address the problem and bolster confidence. Text-based early-warning systems could be 
applied to SME portfolios of customers with revenues of €10 million or more and even to large 
commercial customers. With lexicons of local languages, text-based early-warning systems 
can also allow banks to monitor remote portfolios systematically. For example, Western 
European banks might use such systems to monitor portfolios in Eastern Europe; Malaysian 
and Singaporean banks might monitor customers in new markets such as China, Indonesia, 
and Vietnam. 

Additionally, banks could deploy these tools in industry-trend analysis. Econometric analysis 
has proved useful in predicting an industry or sector’s development, but sentiment analysis 
can complement it to yield a better result. In the short to midterm, an automated and objective 
analysis of news articles on industry outlooks can be helpful. An analysis of the sentiment 
regarding certain industry trends can help credit portfolio managers detect early shifts in 
opinion and initiate remediation measures. Here the sentiment index could be one input in a 
portfolio model; such crowd-sourced opinion can be used to influence banks’ decisions on 
where and how to grow. 

In all these applications, sentiment analysis has distinct advantages over traditional risk 
measures. First, sentiment analysis accesses a completely new kind and source of 
information; it retrieves default factors such as extraordinary events that are hardly covered in 
today’s rating models. Because the information it analyzes is brand new and reflective of 
reality, it overcomes the time lag present in almost all current rating models. Another 
advantage is that some news articles, such as opinion pieces and commentaries, are forward 
looking. Adding such pieces to the sentiment index can give it a prospective bias that nicely 
counteracts the retrospective tendencies of traditional risk systems. 



Two other benefits are also important. Sentiment analysis can be largely automated, including 
the selection and filtering of articles, the calculation of the sentiment index, and the 
production and delivery of reports to the people responsible for them. Additionally, sentiment 
analysis provides a kind of objective measurement of qualitative information. It can help risk 
managers challenge front-office assessments; similarly, it can be a means to enforce regular 
monitoring of company activities. This is particularly important in large, geographically diverse 
banks, helping the central risk-management group monitor the quality of the credit portfolio. 


A prototype analysis 

To demonstrate the power of this new approach, we developed a prototype model tailored to 
the specific needs of banks and their SME or corporate credit-risk models. 1 The system 
uses business journalism as its input data. It analyzes news articles with a proprietary lexicon, 
derived from a comprehensive analysis of a substantial body of content by industry and 
banking experts, and produces a sentiment index. 

We validated the performance of the model by back-testing it with more than 400,000 
articles on over 700 companies from different industries, all with at least $10 million in annual 
revenues. The sample includes listed and unlisted companies; both subsets include some 
companies that defaulted during the period in question. We assessed the performance of the 
model with the measures typically used by banks for this purpose: an accuracy ratio (derived 
from the number of predicted defaults that actually defaulted, which is an assessment of the 
predictive power of the model) and a score for false negatives (predicted defaults that did not 
happen). 

The accuracy rate for the privately held companies in our sample (by far the more interesting 
and challenging credit decisions) ranges from 55 to 80 percent, depending on a progressively 
conservative definition of deterioration and default. The model’s performance compares well 
with a good early-warning system at a leading bank but has the advantage of working from a 
new source of information that complements traditional financial information. 

We also reviewed the performance of the lexicon. A review of a sample of articles revealed 
that three out of four had been classified correctly—that is, the number and kind of phrases in 
the article, cross-referenced to the lexicon, determined an overall positive or negative 
sentiment for the article in the same way that an experienced reader would. 


“Trumpet” picture analyses, named for the shape of their curves, are often used to depict the 
timeliness of default detection by rating models or individual variables. For the listed 
companies in our sample, defaults were detected as much as two years in advance of the 
bankruptcy filing. For our final assessment, we compared the sentiment index of listed 
companies with the performance of their shares. A correlation analysis found that, on 
average, more than 90 percent of all companies in the sample showed a positive correlation 
between the two. Of the remaining companies, in many cases, we found that share prices did 
not vary much because they are thinly traded. Note that the prototype is not a tool to predict 
stock-market movement; rather, the correlation demonstrates that the prototype gathers and 
assesses public information in much the same way as market participants. 


Using textual data to perform sentiment analysis can help banks develop more accurate 
early-warning systems, improve their credit-rating models, and create better portfolio- 
management systems. It also has the potential to help banks better understand customer 
needs, improve customer satisfaction, and ultimately, shape long-term strategy. 


A digital crack in banking’s business 
model 


Low-cost attackers are targeting customers in lucrative parts of the sector. 


T he rise of digital innovators in financial services presents a significant threat to the 
traditional business models of retail banks. Historically, they have generated value by 
combining different businesses, such as financing, investing, and transactions, which serve 
their customers’ broad financial needs over the long haul. Banks offer basic services, such as 
low-cost checking, and so-called sticky customer relationships allow them to earn attractive 
margins in other areas, including investment management, credit-card fees, or foreign- 
exchange transactions. 


To better understand how attackers could affect the economics of banks, we disaggregated 
the origination and sales component from the balance-sheet and fulfillment component of all 
banking products. Our research (exhibit) shows that 59 percent of the banks’ earnings flow 
from pure fee products, such as advice or payments, as well as the origination, sales, and 
distribution component of balance-sheet products, like loans or deposits. In these areas, 
returns on equity (ROE) average an attractive 22 percent. That’s much higher than the 6 
percent ROE of the balance-sheet provision and fulfillment component of products (for 
example, loans), which have high operating costs and high capital requirements. 



Exhibit 


Digital attackers disintermediate profitable customer-facing 
businesses and avoid capital-intensive areas. 


Origination and sales 
Balance-sheet provisioning 1 


Share of Share of after¬ 
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Top two profit generators, 

2014, before risk cost, $ billion 


Asset management 
and insurance 2 


577 


Transactions 
and payments 


483 


Revenues generated by carrying loans and other assets already sold and sitting on the books. 

2 Asset management includes investment and pension products. Only insurance sold by banks is included. 


Digital start-ups (fintechs)—as well as big nonbank technology companies in e-retailing, 
media, and other sectors—could exploit this mismatch in banking’s business model. 
Technological advances and shifts in consumer behavior offer attackers a chance to weaken 
the heavy gravitational pull that banks exert on their customers. Many of the challengers hope 
to disintermediate these relationships, slicing off the higher-ROE segments of banking’s 
value chain in origination and sales, leaving banks with the basics of asset and liability 
management. It’s important that most fintech players (whether start-ups or China’s e- 









messaging and Internet-services provider Tencent) don’t want to be banks and are not asking 
customers to transfer all their financial business at once. They are instead offering targeted 
(and more convenient) services. The new digital platforms often allow customers to open 
accounts effortlessly, for example. In many cases, once they have an account, they can switch 
among providers with a single click. 

Platforms such as NerdWallet (in the United States) or India’s BankBazaar.com aggregate the 
offerings of multiple banks in loans, credit cards, deposits, insurance, and more and receive 
payment from the banks for generating new business. Wealthfront targets fee-averse 
millennials who favor automated software over human advisers. Lending Home targets 
motivated investment-property buyers looking for cost-effective mortgages with accelerated 
time horizons. Moneysupermarket.com started with a single product springboard—consumer 
mortgages—and now not only offers a range of financial products but serves as a platform for 
purchases of telecom and travel services, and even energy. 

Across the emerging fintech landscape, the customers most susceptible to cherry-picking 
are millennials, small businesses, and the underbanked—three segments particularly 
sensitive to costs and to the enhanced consumer experience that digital delivery and 
distribution afford. For instance, Alipay, the Chinese payments service (a unit of e-commerce 
giant Alibaba), makes online finance simpler and more intuitive by turning savings strategies 
into a game and comparing users’ returns with those of others. It also makes peer-to-peer 
transfers fun by adding voice messages and emoticons. 

From an incumbent’s perspective, emerging fintechs in corporate and investment banking 
(including asset and cash management) appear to be less disruptive than retail innovators are. 
A recent McKinsey analysis showed that most of the former, notably those established in the 
last couple of years, are enablers, serving banks directly and often seeking to improve 
processes for one or more elements of banking’s value chain. 

Many successful attackers in corporate and investment banking, as well as some in retail 
banking, are embracing “coopetition,” finding ways to become partners in the ecosystems of 
traditional banks. These fintechs, sidestepping banking basics, rely on established institutions 
and their balance sheets to fulfill loans or provide the payments backbone to fulfill credit-card 
or foreign-exchange transactions. With highly automated, scalable, software-based services 
and no physical-distribution expenses (such as branch networks), these attackers gain a 



significant cost advantage and therefore often offer more attractive terms than banks’ 
websites do. They use advanced data analytics to experiment with new credit-scoring 
approaches and exploit social media to capture shifts in customer behavior. 

Attackers must still overcome the advantages of traditional banks and attract their customers. 
(See the sidebar for the story of how one financial incumbent, Goldman Sachs, is using 
digitization to strengthen its core businesses.) Most fintechs, moreover, remain under the 
regulatory radar today but will attract attention as they reach meaningful scale. That said, the 
rewards for digital success are huge. Capturing even a tiny fraction of banking’s more than $1 
trillion profit pool could generate massive returns for the owners and investors of these start¬ 
ups. Little wonder there are more than 12,000 of them on the prowl today. 



Cutting through the noise around 
financial technology 


We track more than 2,000 start-ups offering traditional and new financial 
services—though we estimate there may be as many as 12,000. Here’s 
how banks should respond. 


B anking has historically been one of the business sectors most resistant to disruption 
by technology. Since the first mortgage was issued in England in the 11th century, 
banks have built robust businesses with multiple moats: ubiquitous distribution through 
branches; unique expertise such as credit underwriting underpinned by both data and 
judgment; even the special status of being regulated institutions that supply credit, the 
lifeblood of economic growth, and have sovereign insurance for their liabilities (deposits). 
Moreover, consumer inertia in financial services is high. Consumers have generally been slow 
to change financial-services providers. Particularly in developed markets, consumers have 
historically gravitated toward the established and enduring brands in banking and insurance 
that were seen as bulwarks of stability even in times of turbulence. 

The result has been a banking industry with defensible economics and a resilient business 
model. In recent decades, banks were also helped by the twin tailwinds of deregulation (in a 
period ushered in by the Depository Institutions Deregulation Act of 1980) and demographics 
(for example, the baby-boom generation came of age and entered its peak earning years). In 
the period between 1984 and 2007, US banks posted average returns on equity (ROE) of 13 
percent. The last period of significant technological disruption, which was driven by the 
advent of commercial Internet and the dot-com boom, provided further evidence of the 



resilience of incumbent banks. In the eight-year period between the Netscape IPO and the 
acquisition of PayPal by eBay, more than 450 attackers—new digital currencies, wallets, 
networks, and so on—attempted to challenge incumbents. Fewer than 5 of these challengers 
survive as stand-alone entities today. In many ways, PayPal is the exception that proves the 
rule: it is tough to disrupt banks. 

The fintech moment 

This may now be changing. Our research into financial-technology (fintech) companies has 
found the number of start-ups is today greater than 2,000, compared with 800 in April 2015. 
Fintech companies are undoubtedly having a moment (Exhibit 1). 



Exhibit 1 


Financial-technology companies are everywhere, especially 
in payments. 
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Retail 


Commercial 3 


Large corporate 
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Lending and financing 
Account management 5 


Segments’ share 
of global banking 
revenues 
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Products/ 
capabilities 


Financial assets 
and capital markets 6 


'350+ commercially most well-known cases registered in the Panorama database; may not be fully 
representative. 

2 Figures may not sum to 100%, because of rounding, 
includes small and medium-size enterprises. 

“Includes large corporates, public entities, and nonbanking financial institutions. 

5 Revenue share includes current/checking-account deposit revenue. 

includes sales and trading, securities services, retail investment, noncurrent-account deposits, and 
asset management factory. 


Globally, nearly $23 billion of venture capital and growth equity has been deployed to fintechs 
over the past five years, and this number is growing quickly: $12.2 billion was deployed in 
2014 alone (Exhibit 2). 




Exhibit 2 


The level of venture-capital investment in financial technology has 
recently accelerated. 
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So we now ask the same question we asked during the height of the dot-com boom: is this 
time different? In many ways, the answer is no. But in some fundamental ways, the answer is 
yes. History is not repeating itself, but it is rhyming. 

The moats historically surrounding banks are not different. Banks remain uniquely and 
systemically important to the economy; they are highly regulated institutions; they largely hold 
a monopoly on credit issuance and risk taking; they are the major repository for deposits, 
which customers largely identify with their primary financial relationship; they continue to be 
the gateways to the world’s largest payment systems; and they still attract the bulk of 
requests for credit. 















Some things have changed, however. First, the financial crisis had a negative impact on trust 
in the banking system. Second, the ubiquity of mobile devices has begun to undercut the 
advantages of physical distribution that banks previously enjoyed. Smartphones enable a new 
payment paradigm as well as fully personalized customer services. In addition, there has been 
a massive increase in the availability of widely accessible, globally transparent data, coupled 
with a significant decrease in the cost of computing power. Two iPhone 6s handsets have 
more memory capacity than the International Space Station. As one fintech entrepreneur 
said, “In 1998, the first thing I did when I started up a fintech business was to buy servers. I 
don’t need to do that today—I can scale a business on the public cloud.” There has also been 
a significant demographic shift. Today, in the United States alone, 85 million millennials, all 
digital natives, are coming of age, and they are considerably more open than the 40 million 
Gen Xers who came of age during the dot-com boom were to considering a new financial- 
services provider that is not their parents’ bank. But perhaps most significantly for banks, 
consumers are more open to relationships that are focused on origination and sales (for 
example, Airbnb, Booking.com, and Uber), are personalized, and emphasize seamless or on- 
demand access to an added layer of service separate from the underlying provision of the 
service or product. Fintech players have an opportunity for customer disintermediation that 
could be significant: McKinsey’s 2015 Global Banking Annual Review estimates that banks 
earn an attractive 22 percent ROE from origination and sales, much higher than the bare- 
bones provision of credit, which generates only a 6 percent ROE (Exhibit 3). 



Exhibit 3 


Origination and sales—the focus of nonbank attackers— 
account for about 60 percent of global banking profits. 
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6% 
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Corporate finance, capital markets, securities services. 

2 Asset management includes investment and pension products. Insurance includes bank-sold 
insurance only. 


Fintech attackers: Six markers of success 

While the current situation differs from the dot-com boom, the failure rate for fintech 
businesses is still likely to be high. However, in a minority of cases, fintechs that focus on the 
retail market will break through and build sustainable businesses, and they are likely to 
profoundly reshape certain areas of financial services—ultimately becoming far more 
successful than the scattered and largely subscale fintech winners of the dot-com boom. 
Absent any mitigating actions by banks, in five major retail-banking businesses—consumer 
finance, mortgages, lending to small and medium-size enterprises, retail payments, and 
















wealth management—from 10 to 40 percent of bank revenues (depending on the business) 
could be at risk by 2025. Attackers are likely to force prices lower and cause margin 
compression. 

We believe the attackers best positioned to create this kind of impact will be distinguished by 
the following six markers: 


Advantaged modes of customer 
acquisition 

Fintech start-ups must still build the most important asset of any business from scratch: 
customers. Banks already have them, and attackers will find it difficult to acquire them cost- 
effectively in most cases. Fintech attackers are subject to the same rules that apply to any e- 
commerce businesses. Over time, a key test of scalability is that gross margins increase while 
customer-acquisition costs decrease. During the dot-com boom, eBay, a commerce 
ecosystem with plenty of customers, was able to reduce PayPal’s cost of customer 
acquisition by more than 80 percent. Fintech attackers this time around will need to find ways 
to attract customers cost-effectively. In the payments point-of-sale (POS) space, several 
fintech attackers, such as Poynt and Revel, are seeking to capitalize on an industry disruption 
—the rollout of EMV (Europay, MasterCard, and Visa—the global standard for chip-based 
debit- and credit-card transactions) in the United States and the resulting acceleration of 
POS replacement cycles. They are attempting to leverage distribution from merchant 
processors and others with existing merchant relationships to acquire merchants as 
customers more quickly and less expensively than would otherwise be possible. 

Step-function reduction in the cost to 
serve 

The erosion of the advantages of physical distribution makes this a distinctive marker for the 
most disruptive fintech attackers. For example, many fintech lenders have up to a 400-basis- 
point cost advantage over banks because they have no physical-distribution costs. While this 



puts a premium on the importance of the first marker, it also enables fintech businesses to 
pass on significant benefits to customers with regard to cost and time to process loan 
applications. 


Innovative uses of data 


Perhaps the most exciting area of fintech innovation is the use of data. For example, several 
players are experimenting with new credit-scoring approaches—ranging from looking at 
college attended and majors for international students with thin or no credit files to trust 
scores based on social-network data. Many of these experiments will fail, stress-tested by 
credit and economic cycles (it is not hard to lend based on different underwriting criteria 
when times are good; the hard part is getting the money back when times are tough). But big 
data and advanced analytics offer transformative potential to predict “next best actions,” 
understand customer needs, and deliver financial services via new mechanisms ranging from 
mobile phones to wearables. Credit underwriting in banks often operates with a case-law 
mind-set and relies heavily on precedent. In a world where more than 90 percent of data has 
been created in the last two years, fintech data experiments hold promise for new products 
and services, delivered in new ways. 

Segment-specific propositions 

The most successful fintech attackers will not begin by revolutionizing all of banking or credit. 
They will cherry-pick, with discipline and focus, those customer segments most likely to be 
receptive to what they offer. For example, Wealthfront targets fee-averse millennials who 
favor automated software over human advisers. LendingHome targets motivated investment- 
property buyers looking for cost-effective mortgages with an accelerated cycle time. Across 
fintech, three segments—millennials, small businesses, and the underbanked—are 
particularly susceptible to this kind of cherry-picking. These segments, with their sensitivity to 
cost, openness to remote delivery and distribution, and large size, offer a major opportunity 
for fintech attackers to build and scale sustainable businesses that create value. Within these 
segments, many customers are open to innovative, remote fintech approaches not offered by 
traditional banks. 



Leveraging existing infrastructure 


Successful fintech attackers will embrace “coopetition” and find ways to engage with the 
existing ecosystem of banks. Lending Club’s credit supplier is Web Bank, and PayPal’s 
merchant acquirer is Wells Fargo. In the same way that Apple did not seek to rebuild telco 
infrastructure from scratch but instead intelligently leveraged what already existed, 
successful fintech attackers will find ways to partner with banks—for example, by acquiring 
underbanked customers that banks cannot serve, or acquiring small-business customers 
with a software-as-a-service offering to run the business overall while a bank partner 
supplies the credit. Apple Pay offers a template for this: with tokenization capabilities 
supplied by the payment networks, it seeks to provide an enhanced digital-wallet customer 
experience in partnership with banks. 

Managing risk and regulatory 
stakeholders 


Fintech attackers are flying largely under the regulatory radar today, but they will attract 
attention as soon as they begin to attain meaningful scale. Those that ignore this dimension of 
building a successful business do so at their own peril. Regulatory tolerance for lapses on 
issues such as anti-money-laundering, compliance, credit-related disparate impact, and 
know-your-customer will be low. Those fintech players that build these capabilities will be 
much better positioned to succeed than those that do not. More broadly, regulation is a key 
swing factor in how fintech disruption could play out. Although unlikely to change the general 
direction, regulation could affect the speed and extent of disruption, if there were material 
shocks that warranted stronger regulatory involvement, such as cybersecurity issues with 
leading fintechs. The impact could also vary significantly by country, given different regulatory 
stances, such as Anglo-Saxon regulation on data usage versus other EU countries, 
payments-system directives in Europe that cause banks to open up their application 
programming interfaces to nonbanks, Brazil’s regulatory stance on peer-to-peer lending, and 
stricter regulation in some Asian markets. 



As with disruptors in any market, the ultimate test of whether a fintech player succeeds or 
fails is whether these six markers combine to create a sustainable new business model. 
Consider what inventory means for Netflix or what storefronts are for Amazon. A successful 
business model would change the basis of competition and drive revenues differently; for 
example, data advantages may be more important than distribution, and revenues may not 
rely on traditional banking spread and fee economics. Despite what is likely to be a high 
failure rate among fintechs, the small number of winners will have a business-model edge 
that sustains them through economic and credit cycles and helps them build enduring brands. 

Banks: Six digital imperatives 

Banks are subject to a lot of noise about fintechs today. Optimism regarding technology is at 
a high, mobility is widely regarded as a game changer, and vast amounts of capital are being 
deployed in fintechs. Banks may be tempted to dismiss the noise entirely, or they may panic 
and overreact. We recommend a middle ground that focuses on separating the signals that 
are truly important from the noise. Specifically, this means that banks should be less 
preoccupied with individual fintech attackers and more focused on what these attackers 
represent—and build or buy the capabilities that matter for a digital future (Exhibit 4). 



Exhibit 4 


Banks should be focused on building an extensive set of distinct 
digital capabilities. 


Data-driven Integrated Digital Digitally Next-gen Digital 

customer marketing enabled technology enablers 

experience operations 



Digital outcomes 

Application programming interfaces. 


Use data-driven insights and analytics 
holistically across the bank 

Attackers powered by data and analytics—be they fintechs, large consumer ecosystems 
(such as Apple, Facebook, and Google), or some of the more progressive financial institutions 
—are opening up new battlegrounds in areas like customer acquisition, customer servicing, 
credit provision, relationship deepening through cross-sell, and customer retention and 
loyalty. Consider the provision of credit—one of banking’s last big moats. Access to large 
quantities of transaction data, underwriting and custom-scoring customers for 
creditworthiness, understanding and managing through credit and economic cycles—these 
are unique assets, skills, and capabilities that banks have built and leveraged over centuries. 












But now the large-scale availability of new and big data (and the fact that banks no longer 
have a monopoly on such data) is pushing banks to radically transform just to keep up. 
Building a comprehensive data ecosystem to access customer data from within and beyond 
the bank, creating a 360-degree view of customer activities, creating a robust analytics-and- 
data infrastructure, and leveraging these to drive scientific (versus case-law-based) decisions 
across a broad range of activities from customer acquisition to servicing to cross-selling to 
collections—all are critical to a bank’s future success. 


Create a well-designed, segmented, and 
integrated customer experience, rather 
than use one-size-fits-all distribution 

The days of banking being dominated by physical distribution are rapidly coming to an end. 
The proliferation of mobile devices and shifting preferences among demographic groups 
mean that customers expect more real-time, cross-channel capabilities (such as status 
inquiries and problem resolution) than ever before. Physical distribution will still be relevant 
but far less important, and banks must learn to deliver services with a compelling design and 
a seamless unconventional customer experience. Banks must recognize that customer 
expectations are increasingly being set by nonbanks. Why does a mortgage application take 
weeks to process? Why does it take an extra week (or two) to get a debit card online versus in 
a branch? Why can’t a customer make a real-time payment from his or her phone to split a 
dinner check? Banks need to respond to these questions by improving their customer 
experience and meeting their customers’ changing expectations. Financial services is the only 
business where you can be rejected as a customer. In an age where mobile devices provide 
real-time transparency on just about everything, it is critical to provide customers with 
information about the status of an application or what other documents are required. Account 
balances must be consistent across channels, and banks should consider the real-time 
updating that an on-demand app such as Uber provides and aim to deliver that level of 
transparency when it matters. Such innovation provides opportunities for banks to improve 
and differentiate their customers’ cross-channel and cross-product experiences. 



Build digital-marketing capabilities that 
equal e-commerce giants 


Today, banks are in a fight for the customer, not only with other banks but also with nonbanks. 
The moats that have historically protected banks will not even begin to compensate for the 
wide gap in marketing skills that currently exists between e-commerce players and banks. 

Big data and the advanced-analytics capabilities described above are merely the foundation 
of digital marketing. Mastering digital media, content marketing, digital customer-life-cycle 
management, and marketing operations will be critical to banks’ success. Building these 
capabilities and recruiting and retaining digital-marketing talent will require considerable time 
and investment. 

Aggressively mitigate the potential cost 
advantage of attackers through radical 
simplification, process digitization, and 
stre amlinin g 

After the last dot-com boom, banks successfully electronified core processes. Now they must 
digitize them. The difference is crucial—an electronic loan-processing and fulfillment process 
at a bank largely implies the sharing and processing of PDF files of paper documents. We 
estimate that the majority of the cost of processing a mortgage is embedded in highly manual 
loops of work and rework. Digitizing a mortgage application would involve creating and 
manipulating data fields, such as borrower income and liabilities, in a largely automated 
manner in the cloud. This would be a multiyear process for banks, as it would require the 
integration of multiple legacy systems and potential replatforming to enable truly digitized 
processes. Simplification, digitization, and streamlining opportunities exist across large 
swaths of banking operations. The sooner banks attack these opportunities, the more 
prepared they will be to compete with fintech attackers that have a structurally lower cost 
base. New technologies will offer banks opportunities to test and scale to achieve 



efficiencies. For example, as the hype surrounding Bitcoin currency fades, it is clear that the 
“baby in the bathwater” may well be distributed ledger technologies that enable more cost- 
effective storage and rapid clearing and settlement of transactions in the banking back office. 


Rapidly leverage and deploy the next 
generation of technologies, from mobile 
to agile to cloud 


The technology agenda for banks and bank CIOs has become even more demanding and 
complex. First and foremost, “mobile first” is not just a buzzword—it is the clearest directive 
banks could receive from consumers about how they want to interact with their service 
providers. Second, banks must fortify not only their technologies, but also their internal 
processes and cultures, to defend customers’ data from breaches. Third, the pace of 
innovation in banking is accelerating rapidly, requiring banks to increase their speed to keep 
up, including software development through techniques such as agile and continuous 
delivery. Finally, significantly faster, nimbler, and dramatically lower-cost versions of 
processing and storage technologies are now commonplace. Banks need to move onto such 
platforms, retiring and replacing legacy systems quickly. Since such systems are neither 
easily nor quickly replaced, many banks may choose to move to a “two-speed architecture” 
approach that builds more flexible layers of technology on top of existing systems but still 
draws on and interacts with those systems to provide the next generation of technology 
agility and seamless customer experiences. From providing truly scalable application 
architecture with a particular emphasis on mobile to addressing the cybersecurity threats 
they face every day to learning agile delivery and modernizing their infrastructure, banks have 
a challenging but important road ahead in building next-generation-technology capabilities. 

Rethink legacy organizational structures 
and decision rights to support a digital 
environment 



The typical organization chart of any bank will show a matrix of products and channels, with 
physical distribution usually leading in size and scope. The profits and losses (P&Ls) that 
accompany these matrices vest power in the owners of the channels and products that are 
most likely to be in the firing line of fintech attackers. These attackers are typically oriented to 
customer metrics tied directly to their financial performance. In contrast, most banks have 
consensus-oriented cultures that require a long time to build alignment. Banks must 
complement their existing P&Ls with approaches that enable faster adaptability to external 
changes, and foster cultures that support speedier decision making. Banks must think hard 
about how best to organize to support the five preceding imperatives, asking what 
organizational structure and decision rights will most effectively support a data- and insight- 
driven operating model, a distinctive customer experience, digitized processes for greater 
efficiency, and next-generation-technology deployment. What innovations should take place 
within the bank? What should be developed in incubators or even in separate digital banks 
under separate brands? Should the bank have separate laboratories or a venture-capitalist- 
like investment vehicle to be able to experiment with new technologies? 

Taken together, these six imperatives carry the same overall implication for banks as the six 
markers do for fintechs: a long-term shift in the nature of competition and successful 
business models. An overarching challenge for banks is how to “open up” structurally—with 
respect to how they leverage partnerships and how they permit other entities to access their 
capabilities. Those banks that pursue a thoughtful approach to meeting this challenge will be 
best positioned to evolve their business models and find new sources of value for their 
customers while performing well financially. 


The age of fintechs is here. Will this time be different from the dot-com boom? Will most 
fintech attackers fail? Will the few attackers who succeed fundamentally reshape banking? 
Regardless of the odds of success for individual fintech attackers, banks must seek 
important signals amid the fintech noise in order to reposition their business models and 
cultures for success. There is no time to lose. 




How the payments industry is being 
disrupted 


While we expect the payments industry to keep growing at a healthy rate, 
powerful disruptive forces will begin to reshape the global landscape. 


G lobal payments revenues have been growing at rates in excess of expectations. 

Once again, Asia—and China in particular—is the primary engine propelling the global 
numbers, but all regions, even those where revenues have recently been in decline, are 
contributing to the surge. Payments growth is currently a truly global phenomenon. 

Looking ahead, however, we expect global payments revenues will begin to reflect the flip 
side of Asia’s prominence as a growth driver. The expected macroeconomic slowdown in 
Asia-Pacific, in other words, is dampening expectations for payments growth overall. 
However, the turnaround in other markets will make up for some of this decline. We forecast 
that this rebalancing between emerging and developed markets will lead to tempered but still 
healthy revenue growth of 6 percent annually through 2019 (exhibit). 



Exhibit 


Global payments revenue is forecasted to grow by 6 percent 
annually for the next five years. 
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1 Figures may not sum, because of rounding. 
2 Compound annual growth rate. 

3 Europe, Middle East, and Africa. 


Our most recent research reveals several additional trends of note. In 2014, as in 2013, growth 
resulted primarily from volume rather than margin growth ($105 billion versus $30 billion). 
Liquidity-related revenues (those linked to outstanding transaction-account balances) were 
again the largest revenue-growth contributor (53 percent). But transaction-related revenues 
(those directly linked to payments transactions) climbed more strongly in Europe, the Middle 
East, and Africa (EMEA), as well as in North America, contributing more to revenues than they 
have in any year since 2008. 







We expect the contribution of transaction-related revenues to continue rising through 2019, 
growing at a compound annual growth rate (CAGR) of 7 percent (compared with 5 percent for 
liquidity revenues) and contributing more to global payments-revenue growth for the period 
($360 billion compared with $220 billion). Weakening macroeconomic fundamentals, 
primarily in Asia-Pacific, will mostly affect worldwide liquidity revenues; transaction-related 
revenues, more driven by payments-specific trends and the ongoing migration of paper to 
digital, will continue to grow at historical rates. Further, the digital revolution in customer 
behavior and the intensifying competition will likely revive the “war on cash,” giving further 
impetus to transaction-related revenues. Still, with CAGRs of 9 percent in EMEA and 7 
percent in North America, liquidity revenues should continue to grow as interbank rates 
recover from historically low levels. 

We also anticipate a rebalancing of revenue growth. During the past five years, payments 
revenues grew at a CAGR of 18 percent for Asia-Pacific and Latin America combined, 
comparing favorably with flat revenues in EMEA and North America. During the next five 
years, however, these growth rates will be 6.5 percent and 6 percent, respectively. 

Setting aside changes in macroeconomic fundamentals that are difficult to predict, we 
foresee four potential disruptions that will alter the payments landscape in the coming years: 

• Nonbank digital entrants will transform the customer experience, reshaping the 
payments and broader financial-services landscape. The payments industry has 
recently seen the entry of diverse nonbank digital players, both technology giants and 
start-ups, that are presenting increased competition for banks. While start-ups have 
generally not been a major threat to the banking industry in the past, we believe things 
will be different this time due to the nature of the attackers, the prominence of 
smartphones as a channel, and rapidly evolving customer expectations. To maintain 
their customer relationships and stay relevant, banks will need to respond to these 
changes with new strategies, capabilities, and operating models. 

• Modernization of domestic payments infrastructures is under way. The industry is 
currently going through a wave of infrastructure modernization that is required to 
compete effectively with nonbank innovators and address evolving customer needs. 
More than 15 countries have modernized their payments infrastructures in the past few 
years, and many others are in the planning stage. Because infrastructure upgrades are 



costly at both the system and bank levels, banks need to find ways to build products 
and services on top of the infrastructure that provide value to end users and accelerate 
the war on cash, in order to recover these investments as quickly as possible. 

• Cross-border payments inefficiencies are opening doors for new players. The 

entry of nonbank players and new infrastructure demands are not limited to domestic 
payments: they will also affect cross-border payments. To date, banks have done little 
to improve the back-end systems and processes involved in cross-border payments. As 
a result, cross-border payments remain expensive for customers, who also face 
numerous pain points (for example, lack of transparency and tracking, as well as slow 
processing times). However, as nonbank players increasingly encroach on the 
traditional cross-border turf of banks—moving from consumer-to-consumer to 
business-to-business cross-border payments—they will force many banks to rethink 
their long-standing approaches to cross-border payments. 

• Digitization in retail banking has important implications for transaction bankers. 

The digital revolution will extend well beyond consumer payments and retail banking, 
causing significant changes in transaction banking. As customers grow accustomed to 
faster and more convenient payments on the retail side, they will soon demand similar 
conveniences and service levels in transaction banking. Having witnessed the impact of 
nonbanks in consumer banking, transaction bankers are becoming more aware of the 
nonbank threat in their own backyard and of the potentially major downside of failing to 
invest in digital infrastructures and services. 


Overall, we expect to see the payments industry continue to grow at a moderated yet healthy 
rate during the next five years. But amid that growth, there will be a rebalancing of revenue 
sources, and, more important, powerful disruptive forces will begin to reshape the global 
payments landscape. 




Decoding financial-technology 
innovation 


Start-ups are eyeing a wider revenue pool across a growing and broader 
range of products and services. 


T he next wave of the financial-technology revolution that started only a few years ago 
has arrived, and this time the impact will be broader. The earlier wave mostly hit 
payment transactions, which was an easy area to disrupt but represents only 6 percent of 
global banking-revenue pools. 

We mapped those pools, across various products and business lines, against our database of 
over 1,200 financial-technology innovations. By conducting a deeper analysis of more than 
350 of them, we found that start-ups are targeting the more lucrative retail-banking segment, 
which accounts for 52 percent of total industry revenues. The exhibit shows that the two 
biggest priorities outside payment transactions are retail lending (which has revenues twice 
as large as payment transactions does across all segments) and retail savings and 
investments (with 15 percent of global revenues). Start-ups in these areas are using peer-to- 
peer solutions, social technologies, and advanced data analytics to develop products, 
manage risk, and improve service. These firms are also beginning to target small to midsize 
enterprises—mostly in payment transactions, with some advances in credit and risk scoring 
as well. They are mostly staying away from large corporations and institutions for the time 
being. 



Banks should be monitoring innovations from five types of players: business-model 
disruptors, process innovators, technology start-ups outside the financial sector, digital 
banks, and platform attackers from other industries, such as e-tailing. Some of these 
innovations might radically reinvent banking; many can improve how banks currently do 
business. Decoding this landscape will be essential for them. 



Exhibit 


Start-ups are targeting the more lucrative retail-banking segment, 
which accounts for 52 percent of total industry revenues. 


Start-ups and innovations as % of total , 1 by customer segment 2 (n = >350) 
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Digital America: A tale of the haves 
and have-mores 


While the most advanced sectors, companies, and individuals push the 
boundaries of technology use, the US economy as a whole is realizing only 
18 percent of its digital potential. 


D igital capabilities, adoption, and usage are evolving at a supercharged pace. While 
most users scramble just to keep up with the relentless rate of innovation, the sectors, 
companies, and individuals on the digital frontier continue to push the boundaries of 
technology use—and to capture disproportionate gains as a result. 

The pronounced gap between the digital “haves” and “have-mores” is a major factor shaping 
competition at all levels of the economy. The companies leading the charge are winning the 
battle for market share and profit growth; some are reshaping entire industries to their own 
advantage. Workers with the most sophisticated digital skills are in such high demand that 
they command wages far above the national average. Meanwhile, there is a growing 
opportunity cost for the organizations and individuals that fall behind. 

Our new McKinsey Global Institute (MGI) report, Digital America: A tale of the haves and have- 
mores, represents the first major attempt to measure the ongoing digitization of the US 
economy at a sector level. It introduces the MGI Industry Digitization Index, which combines 
dozens of indicators to provide a comprehensive picture of where and how companies are 



building digital assets, expanding digital usage, and creating a more digital workforce. In 
addition to the information- and communication-technology sector, media, financial services, 
and professional services are surging ahead, while others have significant upside to capture. 

The report also quantifies the considerable gap between the most digitized sectors and the 
rest of the economy over time and finds that despite a massive rush of adoption, most sectors 
have barely closed that gap over the past decade. The lagging sectors are less than 15 
percent as digitized as the leading sectors (exhibit). In fact, because the less digitized sectors 
are some of the largest in terms of GDP contribution and employment, we find that the US 
economy as a whole is only reaching 18 percent of its digital potential (defined as the upper 
bounds of usage by the leading sectors across a variety of metrics). 



Exhibit 


The most digitized sectors are maintaining a considerable 
lead over the rest of the US economy. 
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Source: ARP Research; DMA; US Bureau of Economic Analysis; US Bureau of Labor Statistics; 
McKinsey social-technology surveys in 2007 (n = 1,867) and 2014 (n = 2,346); McKinsey Global 
Institute analysis 










This gap underscores not only the challenge of continuously adapting but also the size of the 
opportunity still ahead. In fact, some of the sectors that are currently lagging could be poised 
for rapid productivity growth. Companies in manufacturing, energy, and other heavy industries 
are investing in digitizing their extensive physical assets, bringing us closer to the era of 
connected cars, smart buildings, and intelligent oil fields. Looking at just three big areas of 
potential—online talent platforms, big data analytics, and the Internet of Things—we estimate 
that digitization could add up to $2.2 trillion to annual GDP by 2025. But the possibilities for 
growth are much wider. The expansion of the digital frontier shows no sign of slowing, and we 
have barely scratched the surface of the many markets that could be transformed. 

Even as digitization creates opportunities for growth, it is likely to unleash economic 
dislocation. As digital technologies automate many of the tasks that humans are paid to do, 
the day-to-day nature of work will change in a majority of occupations. Companies will 
redefine many roles and business processes, affecting workers of all skill levels. Historical 
job-displacement rates could accelerate sharply over the next decade. The United States will 
need to adapt its institutions and training pathways to help workers acquire relevant skills and 
navigate this period of transition and churn. 

Digitization is changing the dynamics in many industries. New markets are proliferating, value 
chains are breaking up, and profit pools are shifting. Businesses that rely too heavily on a 
single revenue stream or on playing an intermediary role in a given market are particularly 
vulnerable. In some markets, there is a winner-take-all effect. For companies, this is a wake- 
up call to use their digital transformation to reinvent every process with a fresh focus on the 
customer. 

Could your job be automated? Find out at Tableau Public, where we analyzed more than 750 
occupations in the United States to determine the percentage of time that could be 
automated by currently demonstrated technology. 



The four global forces breaking all the 
trends 


The world economy’s operating system is being rewritten. In this exclusive 
excerpt from the new book No Ordinary Disruption, its authors explain the 
trends reshaping the world and why leaders must adjust to a new reality. 


I n the Industrial Revolution of the late 18th and early 19th centuries, one new force 
changed everything. Today our world is undergoing an even more dramatic transition due 
to the confluence of four fundamental disruptive forces—any of which would rank among the 
greatest changes the global economy has ever seen. Compared with the Industrial 
Revolution, we estimate that this change is happening ten times faster and at 300 times the 
scale, or roughly 3,000 times the impact. Although we all know that these disruptions are 
happening, most of us fail to comprehend their full magnitude and the second- and third- 
order effects that will result. Much as waves can amplify one another, these trends are gaining 
strength, magnitude, and influence as they interact with, coincide with, and feed upon one 
another. Together, these four fundamental disruptive trends are producing monumental 
change. 


1. Beyond Shanghai: The age of 
urbanization 



The first trend is the shifting of the locus of economic activity and dynamism to emerging 
markets like China and to cities within those markets. These emerging markets are going 
through simultaneous industrial and urban revolutions, shifting the center of the world 
economy east and south at a speed never before witnessed. As recently as 2000,95 percent 
of the Fortune Global 500—the world’s largest international companies including Airbus, IBM, 
Nestle, Shell, and The Coca-Cola Company, to name a few—were headquartered in 
developed economies. By 2025, when China will be home to more large companies than 
either the United States or Europe, we expect nearly half of the world’s large companies— 
defined as those with revenue of $1 billion or more—to be headquartered in emerging 
markets. “Over the years, people in our headquarters, in Frankfurt, started complaining to me, 
‘We don’t see you much around here anymore,”’ said Josef Ackermann, the former chief 
executive officer of Deutsche Bank. “Well, there was a reason why: growth has moved 
elsewhere—to Asia, Latin America, the Middle East.” 


Slideshow 


Explore the four disruptive forces that will change the global economy. 
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Perhaps equally important, the locus of economic activity is shifting within these markets. The 
global urban population has been rising by an average of 65 million people annually during 
the past three decades, the equivalent of adding seven Chicagos a year, every year. Nearly 
half of global GDP growth between 2010 and 2025 will come from 440 cities in emerging 
markets—95 percent of them small- and medium-size cities that many Western executives 
may not even have heard of and couldn’t point to on a map. Yes, Mumbai, Dubai, and 
Shanghai are familiar. But what about Hsinchu, in northern Taiwan? Brazil’s Santa Catarina 
state, halfway between Sao Paulo and the Uruguayan border? Or Tianjin, a city that lies 
around 120 kilometers southeast of Beijing? In 2010, we estimated that the GDP of Tianjin 
was around $130 billion, making it around the same size as Stockholm, the capital of Sweden. 
By 2025, we estimate that the GDP of Tianjin will be around $625 billion—approximately that 
of all of Sweden. 

2. The tip of the iceberg: Accelerating 
technological change 

The second disruptive force is the acceleration in the scope, scale, and economic impact of 
technology. Technology—from the printing press to the steam engine and the Internet—has 
always been a great force in overturning the status quo. The difference today is the sheer 
ubiquity of technology in our lives and the speed of change. It took more than 50 years after 
the telephone was invented until half of American homes had one. It took radio 38 years to 
attract 50 million listeners. But Facebook attracted 6 million users in its first year and that 
number multiplied 100 times over the next five years. China’s mobile text- and voice¬ 
messaging service WeChat has 300 million users, more than the entire adult population of 
the United States. Accelerated adoption invites accelerated innovation. In 2009, two years 
after the iPhone’s launch, developers had created around 150,000 applications. By 2014, that 
number had hit 1.2 million, and users had downloaded more than 75 billion total apps, more 
than ten for every person on the planet. As fast as innovation has multiplied and spread in 
recent years, it is poised to change and grow at an exponential speed beyond the power of 
human intuition to anticipate. 

Processing power and connectivity are only part of the story. Their impact is multiplied by the 
concomitant data revolution, which places unprecedented amounts of information in the 
hands of consumers and businesses alike, and the proliferation of technology-enabled 



business models, from online retail platforms like Alibaba to car-hailing apps like Uber. 

Thanks to these mutually amplifying forces, more and more people will enjoy a golden age of 
gadgetry, of instant communication, and of apparently boundless information. Technology 
offers the promise of economic progress for billions in emerging economies at a speed that 
would have been unimaginable without the mobile Internet. Twenty years ago, less than 3 
percent of the world’s population had a mobile phone; now two-thirds of the world’s 
population has one, and one-third of all humans are able to communicate on the Internet. 
Technology allows businesses such as WhatsApp to start and gain scale with stunning speed 
while using little capital. Entrepreneurs and start-ups now frequently enjoy advantages over 
large, established businesses. The furious pace of technological adoption and innovation is 
shortening the life cycle of companies and forcing executives to make decisions and commit 
resources much more quickly. 

3. Getting old isn’t what it used to be: 
Responding to the challenges of an aging 
world 

The human population is getting older. Fertility is falling, and the world’s population is graying 
dramatically. While aging has been evident in developed economies for some time—Japan 
and Russia have seen their populations decline over the past few years—the demographic 
deficit is now spreading to China and soon will reach Latin America. For the first time in 
human history, aging could mean that the planet’s population will plateau in most of the world. 
Thirty years ago, only a small share of the global population lived in the few countries with 
fertility rates substantially below those needed to replace each generation—2.1 children per 
woman. But by 2013, about 60 percent of the world’s population lived in countries with 
fertility rates below the replacement rate. This is a sea change. The European Commission 
expects that by 2060, Germany’s population will shrink by one-fifth, and the number of 
people of working age will fall from 54 million in 2010 to 36 million in 2060, a level that is 
forecast to be less than France’s. China’s labor force peaked in 2012, due to income-driven 
demographic trends. In Thailand, the fertility rate has fallen from 5 in the 1970s to 1.4 today. A 
smaller workforce will place a greater onus on productivity for driving growth and may cause 
us to rethink the economy’s potential. Caring for large numbers of elderly people will put 
severe pressure on government finances. 



4. Trade, people, finance, and data: 
Greater global connections 

The final disruptive force is the degree to which the world is much more connected through 
trade and through movements in capital, people, and information (data and communication)— 
what we call “flows.” Trade and finance have long been part of the globalization story but, in 
recent decades, there’s been a significant shift. Instead of a series of lines connecting major 
trading hubs in Europe and North America, the global trading system has expanded into a 
complex, intricate, sprawling web. Asia is becoming the world’s largest trading region. 
“South-south” flows between emerging markets have doubled their share of global trade 
over the past decade. The volume of trade between China and Africa rose from $9 billion in 
2000 to $211 billion in 2012. Global capital flows expanded 25 times between 1980 and 
2007. More than one billion people crossed borders in 2009, over five times the number in 
1980. These three types of connections all paused during the global recession of 2008 and 
have recovered only slowly since. But the links forged by technology have marched on 
uninterrupted and with increasing speed, ushering in a dynamic new phase of globalization, 
creating unmatched opportunities, and fomenting unexpected volatility. 

Resetting intuition 

These four disruptions gathered pace, grew in scale, and started collectively to have a 
material impact on the world economy around the turn of the 21st century. Today, they are 
disrupting long-established patterns in virtually every market and every sector of the world 
economy—indeed, in every aspect of our lives. Everywhere we look, they are causing trends 
to break down, to break up, or simply to break. The fact that all four are happening at the 
same time means that our world is changing radically from the one in which many of us grew 
up, prospered, and formed the intuitions that are so vital to our decision making. 

This can play havoc with forecasts and pro forma plans that were made simply by 
extrapolating recent experience into the near and distant future. Many of the assumptions, 
tendencies, and habits that had long proved so reliable have suddenly lost much of their 
resonance. We’ve never had more data and advice at our fingertips—literally. The iPhone or 
the Samsung Galaxy contains far more information and processing power than the original 



supercomputer. Yet we work in a world in which even, perhaps especially, professional 
forecasters are routinely caught unawares. That’s partly because intuition still underpins 
much of our decision making. 

Our intuition has been formed by a set of experiences and ideas about how things worked 
during a time when changes were incremental and somewhat predictable. Globalization 
benefited the well established and well connected, opening up new markets with relative 
ease. Labor markets functioned quite reliably. Resource prices fell. But that’s not how things 
are working now—and it’s not how they are likely to work in the future. If we look at the world 
through a rearview mirror and make decisions on the basis of the intuition built on our 
experience, we could well be wrong. In the new world, executives, policy makers, and 
individuals all need to scrutinize their intuitions from first principles and boldly reset them if 
necessary. This is especially true for organizations that have enjoyed great success. 


While it is full of opportunities, this era is deeply unsettling. And there is a great deal of work 
to be done. We need to realize that much of what we think we know about how the world 
works is wrong; to get a handle on the disruptive forces transforming the global economy; to 
identify the long-standing trends that are breaking; to develop the courage and foresight to 
clear the intellectual decks and prepare to respond. These lessons apply as much to policy 
makers as to business executives, and the process of resetting your internal navigation 
system can’t begin soon enough. 

There is an urgent imperative to adjust to these new realities. Yet, for all the ingenuity, 
inventiveness, and imagination of the human race, we tend to be slow to adapt to change. 
There is a powerful human tendency to want the future to look much like the recent past. On 
these shoals, huge corporate vessels have repeatedly foundered. Revisiting our assumptions 
about the world we live in—and doing nothing—will leave many of us highly vulnerable. 
Gaining a clear-eyed perspective on how to negotiate the changing landscape will help us 
prepare to succeed. 



Unlocking the potential of the 
Internet of Things 


If policy makers and businesses get it right, linking the physical and digital 
worlds could generate up to $11.1 trillion a year in economic value by 2025. 


T he Internet of Things— sensors and actuators connected by networks to computing 
systems—has received enormous attention over the past five years. A new McKinsey 
Global Institute report, The Internet of Things: Mapping the value beyond the hype, attempts 
to determine exactly how loT technology can create real economic value. 

Our central finding is that the hype may actually understate the full potential—but that 
capturing it will require an understanding of where real value can be created and a successful 
effort to address a set of systems issues, including interoperability. 

To get a broader view of the loT’s potential benefits and challenges across the global 
economy, we analyzed more than 150 use cases, ranging from people whose devices monitor 
health and wellness to manufacturers that utilize sensors to optimize the maintenance of 
equipment and protect the safety of workers. Our bottom-up analysis for the applications we 
size estimates that the loT has a total potential economic impact of $3.9 trillion to $11.1 trillion 
a year by 2025. At the top end, that level of value—including the consumer surplus—would be 
equivalent to about 11 percent of the world economy (exhibit). 





Exhibit 


The Internet of Things offers a potential economic impact 
of $4 trillion to $11 trillion a year in 2025. 

Nine settings Size j n 2025, $ trillion 1 

where value may accrue 

■ Low estimate □ High estimate 


Factories —eg, operations management, 
predictive maintenance 


Cities —eg, public safety and health, traffic 
control, resource management 


Human —eg, monitoring and managing 
illness, improving wellness 


Retail— eg, self-checkout, layout optimization, 
smart customer-relationship management 


Outside —eg, logistics routing, autonomous 
(self-driving) vehicles, navigation 


Work sites —eg, operations management, 
equipment maintenance, health and safety 


Vehicles —eg, condition-based maintenance, 
reduced insurance 


Homes —eg, energy management, safety 
and security, chore automation 



] 0.2-0.3 


Offices —eg, organizational redesign and 
worker monitoring, augmented reality for training 


Total $4 trillion—$11 trillion 

Adjusted to 2015 dollars; for sized applications only; includes consumer surplus. Numbers do not 
sum to total, because of rounding. 


Achieving this kind of impact would require certain conditions to be in place, notably 
overcoming the technical, organizational, and regulatory hurdles. In particular, companies that 
use loT technology will play a critical role in developing the right systems and processes to 
maximize its value. Among our findings: 




















• Interoperability between loT systems is critical. Of the total potential economic value 
the loT enables, interoperability is required for 40 percent on average and for nearly 60 
percent in some settings. 

• Currently, most loT data are not used. For example, on an oil rig that has 30,000 
sensors, only 1 percent of the data are examined. That’s because this information is 
used mostly to detect and control anomalies—not for optimization and prediction, 
which provide the greatest value. 

• Business-to-business applications will probably capture more value—nearly 70 
percent of it—than consumer uses, although consumer applications, such as fitness 
monitors and self-driving cars, attract the most attention and can create significant 
value, too. 

• The loT has a large potential in developing economies. Still, we estimate that it will have 
a higher overall value impact in advanced economies because of the higher value per 
use. However, developing economies could generate nearly 40 percent of the loT’s 
value, and nearly half in some settings. 

• Customers will capture most of the benefits. We estimate that loT users (businesses, 
other organizations, and consumers) could capture 90 percent of the value that loT 
applications generate. For example, in 2025 remote monitoring could create as much 
as $1.1 trillion a year in value by improving the health of chronic-disease patients. 

• A dynamic industry is evolving around loT technology. As in other technology waves, 
both incumbents and new players have opportunities. Digitization blurs the lines 
between technology companies and other types of businesses; makers of industrial 
machinery, for example, are creating new business models by using loT links and data 
to offer their products as a service. 


The digitization of machines, vehicles, and other elements of the physical world is a powerful 
idea. Even at this early stage, the loT is starting to have a real impact by changing how goods 
are made and distributed, how products are serviced and refined, and how doctors and 
patients manage health and wellness. But capturing the full potential of loT applications will 




require innovation in technologies and business models, as well as investment in new 
capabilities and talent. With policy actions to encourage interoperability, ensure security, and 
protect privacy and property rights, the Internet of Things can begin to reach its full potential 
—especially if leaders truly embrace data-driven decision making. 



Getting big impact from big data 


T he world has become excited about big data and advanced analytics not just because 
the data are big but also because the potential for impact is big. Our colleagues at the 
McKinsey Global Institute (MGI) caught many people’s attention several years ago when they 
estimated that retailers exploiting data analytics at scale across their organizations could 
increase their operating margins by more than 60 percent and that the US healthcare sector 
could reduce costs by 8 percent through data-analytics efficiency and quality improvements. 


Unfortunately, achieving the level of impact MGI foresaw has proved difficult. True, there are 
successful examples of companies such as Amazon and Google, where data analytics is a 
foundation of the enterprise. But for most legacy companies, data-analytics success has 
been limited to a few tests or to narrow slices of the business. Very few have achieved what 
we would call “big impact through big data,” or impact at scale. For example, we recently 
assembled a group of analytics leaders from major companies that are quite committed to 
realizing the potential of big data and advanced analytics. When we asked them what degree 
of revenue or cost improvement they had achieved through the use of these techniques, 
three-quarters said it was less than 1 percent. 



In previous articles, we’ve shown how capturing the potential of data analytics requires the 
building blocks of any good strategic transformation: it starts with a plan, demands the 
creation of new senior-management capacity to really focus on data, and, perhaps most 
important, addresses the cultural and skill-building challenges needed for the front line (not 
just the analytics team) to embrace the change. 

Here, we want to focus on what to do when you’re in the midst of that transformation and 
facing the inevitable challenges to realizing large-scale benefits (exhibit). For example, 
management teams frequently don’t see enough immediate financial impact to justify 
additional investments. Frontline managers lack understanding and confidence in the 
analytics and hesitate to employ it. Existing organizational processes are unable to 
accommodate advancements in analytics and automation, often because protocols for 
decision making require multiple levels of approval. 



Exhibit 


How to accelerate your data-analysis transformation 



Ask different questions 
Take multiple perspectives 
See the system 

Set a direction, experiment, 
amplify, and dampen 


• Dissect, prune, and drill 

• Align key stakeholders 

• Optimize one piece at a time 

• Set a destination, pilot, 
scale, and roll out 


If you see your organization struggling with these impediments to scaling data-analytics 
efforts, the first step is to make sure you are doing enough to adopt some of the new tools 
that are emerging to help deal with such challenges. These tools deliver fast results, build the 
confidence of the front line, and automate the delivery of analytic insights to it in usable 
formats. 

But the tools alone are insufficient. Organizational adaptation is also needed to overcome fear 
and catalyze change. Management teams need to shift priorities from small-scale exercises 
to focusing on critical business areas and driving the use of analytics across the organization. 




And at times, jobs need to be redesigned to embrace advancements in digitization and 
automation. An organization that quickly adopts new tools and adapts itself to capture their 
potential is more likely to achieve large-scale benefits from its data-analytics efforts. 


Why data-analytics efforts bog down 
before they get big 


As recently as two or three years ago, the key challenges for data-analytics leaders were 
getting their senior teams to understand its potential, finding enough talent to build models, 
and creating the right data fabric to tie together the often disparate databases inside and 
outside the enterprise. But as these professionals have pushed for scale, new challenges 
have emerged. 

First, many senior managers are reluctant to double down on their investments in analytics- 
investments required for scale, because early efforts have not yielded a significant return. In 
many cases, they were focused on more open-ended efforts to gain novel insights from big 
data. These efforts were fueled by analytics vendors and data scientists who were eager to 
take data and run all types of analyses in the hope of finding diamonds. Many executives 
heard the claim “just give us your data, and we will find new patterns and insights to drive your 
business.” 

These open-ended exercises often yielded novel insights, without achieving large-scale 
results. For example, an executive at one automaker recently invested in an initiative to 
understand how social media could be used to improve production planning and forecasting. 
While the analysis surfaced interesting details on customer preferences, it didn’t provide 
much guidance on how to improve the company’s forecasting approach. Executives can often 
point to examples such as this one where early efforts to understand interesting patterns 
were not actionable or able to influence business results in a meaningful way. The upshot: 
senior management often is hesitant about financing the investments required for scale, such 
as analytics centers of excellence, tools, and training. 

Second, frontline managers and business users frequently lack confidence that analytics will 
improve their decision making. One of the common complaints from this audience is that the 
tools are too much like black boxes; managers simply don’t understand the analytics or the 



recommendations it suggests. Frontline managers and business users understandably fall 
back on their historic rules of thumb when they don’t trust the analytics, particularly if their 
analytics-based tools are not easy to use or are not embedded into established workflows 
and processes. For example, at a sales call center, staff members failed to use a product- 
recommendation engine because they didn’t know how the tool formulated the 
recommendations and because it was not user friendly. Once the tool was updated to explain 
why the recommendations were being made and the interface was improved, adoption 
increased dramatically. 

Finally, a company’s core processes can also be a barrier to capturing the potential of 
sophisticated analytics. For the “born through analytics” companies, like Amazon and 
Facebook, processes such as pricing, ad serving, and supply-chain management have been 
built around a foundation of automated analytics. These organizations also have built big data 
processing systems that support automation and developed recruiting approaches that 
attract analytics talent. 

But in more established organizations, management-approval processes have not kept up 
with the advancements in data analytics. For example, it’s great to have real-time data and 
automated pricing engines, but if management processes are designed to set prices on a 
weekly basis, the organization won’t be able to realize the full impact of these new 
technologies. Moreover, organizations that fail to leverage such enhancements risk falling 
behind. 

Adopting new technologies to scale 
impact 


Few areas are experiencing more innovation and investment than big data and analytics. New 
tools and improved approaches across the data-analytics ecosystem are offering ways to 
deal with the challenge of achieving scale. From our vantage point, three hold particular 
promise. 

First is the emergence of targeted solutions from analytics-based software and service 
providers that are helping their clients achieve a more direct, and at times faster, impact on 
the bottom line. An emerging class of analytics specialists builds models targeted to specific 



use cases. These models have a clear business focus and can be implemented swiftly. We are 
seeing them successfully applied in a wide range of areas: logistics, risk management, pricing, 
and personnel management, to name just a few. Because these more specific solutions have 
been applied across dozens of companies, they can be deployed more readily. Collectively, 
such targeted applications will help raise management’s confidence in investing to gain scale. 
There’s still a need for a shift in culture and for a heavy emphasis on adoption, but the more 
focused tools represent a big step forward. 

Second, new self-service tools are building business users’ confidence in analytics. One hot 
term gaining traction in the analytics world is “democratization.” Getting analytics out of the 
exclusive hands of the statistics gurus, and into the hands of a broad base of frontline users, is 
seen as a key building block for scale. Without needing to know a single line of coding, 
frontline users of new technology tools can link data from multiple sources (including external 
ones) and apply predictive analytics. Visualization tools, meanwhile, are putting business 
users in control of the analytics tools by making it easy to slice and dice data, define the data 
exploration needed to address the business issues, and support decision making. Companies 
such as American Express, Procter & Gamble, and Walmart have made major investments in 
these types of tools to democratize the use of analytics. 

Hands-on experience (guided by experts in early go-rounds) helps people grow accustomed 
to using data. That builds confidence and, over time, can increase the scale and scope of 
data-informed problem solving and decision support. A technology-hardware company, for 
example, deployed a set of self-service analytics and visualization tools to improve the 
decisions of its sales force. The new platform helped the company to conduct customer 
analytics and to better identify sales and renewal opportunities. Since implementing the tools, 
the tech company has generated more than $100 million in new revenue from support and 
service contracts. 

Finally, it’s becoming much easier to automate processes and decision making. Technology 
improvements are allowing a much broader capture of real-time data (for example, through 
sensors) while facilitating real-time, large-scale data processing and analysis. These 
advances are opening new pathways to automation and machine learning that were 
previously available only to leading technology firms. For example, one insurer has made 
major strides using analytics to predict the severity of claims. Automated systems instantly 
compare a filing with millions of claims records, cutting down the need for human intervention. 



Another analytics program can vastly automate search-engine optimization by predicting the 
type of content that will optimize engagement for a given company and automatically serving 
up content to capture customers. 


Beyond new tools: Adapting the 
organization 

The challenges we outlined above demand some new actions beyond the tools: more focus, 
more job redefinition, and more cultural change. 

Focus on change management 

Democratization and the power of new tools can help overcome frontline doubts and 
unfamiliarity with analytics. However, in addition to gaining confidence, managers need to 
change their way of making decisions to take advantage of analytics. This is the heart of the 
change-management challenge—it is not easy, and it takes time. The implication is that to 
achieve scale, paradoxically, you need to focus. Trying to orchestrate change in all of a 
company’s daily decision-making and operating approaches is too overwhelming to be 
practical. In our experience, though, it’s possible to drive adoption and behavioral change 
across the full enterprise in focused areas such as pricing, inventory allocation, or credit 
management. Better to pursue scale that’s achievable than to overreach and be disappointed 
or to scatter pilots all over the organization. (One-off pilots often appeal to early adopters but 
fail to cross the chasm and reach wider adoption or to build momentum for company-wide 
change.) 

Leaders should ask themselves which functions or departments would benefit most from 
analytics and deploy a combination of new targeted solutions, visualization tools, and change 
management and training in those few areas. One telecommunications company, for example, 
focused on applying analytics to improve customer-churn management, which held the 
potential for a big bottom-line impact. That required the company to partner with a leading 
data-storage and analytics player to identify (in near real time) customers who would churn. 
Once the models were developed, a frontline transformation effort was launched to drive 



adoption of the tools. Moreover, customer-service workflows were redesigned, user-friendly 
frontline apps were deployed, and customer-service agents received training for all of the 
new tools. 

Redesign jobs 

Automating part of the jobs of employees means making a permanent change in their roles 
and responsibilities. If you automate pricing, for instance, it is hard to hold the affected 
manager solely responsible for the profit and loss of the business going forward, since a key 
part of the profit formula is now made by a machine. As managerial responsibilities evolve or 
are eliminated altogether, organizations will have to adapt by redefining roles to best leverage 
and support the ongoing development of these technologies. At the insurance company 
above, claims managers no longer process all claims; instead, they focus on the exceptional 
ones, with the highest level of complexity or the most severe property damage. Again, focus is 
required, since job redesign is time consuming. And it can be taken on only if the automated 
tools and new roles have been developed and tested to meet whatever surprises our volatile 
world throws at them. 

Build a foundation of analytics in your 
culture 


People have been talking about data-driven cultures for a long time, but what it takes to 
create one is changing as a result of the new tools available. Companies have a wider set of 
options to spur analytics engagement among critical employees. A leading financial-services 
firm, for example, began by developing competitions that rewarded and recognized those 
teams that could generate powerful insights through analytics. Second, it established training 
boot camps where end users would learn how to use self-service tools. Third, it created a 
community of power users to support end-users in their analyses and to validate findings. 
Finally, the company established a communications program to share the excitement through 
analytics meet-ups, leadership communications, and newsletters (which were critical to 



maintaining long-term support for the program). Creative adaptations like these will help 
companies to move beyond the hope that “we are going to be a big data company” and to root 
cultural change in realistic action. 


New technologies, with their ease of adoption, point toward the next horizon of data analytics. 
For a glimpse of what the future might hold, consider what’s happening now at a leading 
organization that has adopted an innovative approach to embedding analytics capabilities 
within its businesses. 

The company started with early-stage centers of excellence and a small corps of analytics 
specialists tackling business cases in bespoke fashion. Today, it rotates business leaders into 
a new type of analytics center, where they learn the basics about new tools and how to apply 
them. Then they bring these insights back to their respective business. They don’t become 
analytics specialists or data scientists by any means, but they emerge capable of taking 
analytics beyond experiments and applying it to the real business problems and opportunities 
they encounter daily. 

We foresee the day when many companies will be running tens or even hundreds of 
managers through centers like these. That will accelerate adoption—particularly as analytics 
tools become ever more frontline friendly—and create the big impact that big data has 
promised. 
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